diff --git a/modules/services/actual.nix b/modules/services/actual.nix
index 6396397..610e5ff 100644
--- a/modules/services/actual.nix
+++ b/modules/services/actual.nix
@@ -51,6 +51,15 @@ in
 
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
+      # Upstream services.actual uses DynamicUser; without a static passwd entry,
+      # activation-time chown (e.g. agenix) for owner "actual" fails.
+      users.groups.actual = { };
+      users.users.actual = {
+        isSystemUser = true;
+        group = "actual";
+        description = "Actual Budget server";
+      };
+
       services.actual = {
         enable = true;
         openFirewall = true;