diff --git a/modules/nixos/homeassistant/default.nix b/modules/nixos/homeassistant/default.nix
index 95c1c33..96e417c 100755
--- a/modules/nixos/homeassistant/default.nix
+++ b/modules/nixos/homeassistant/default.nix
@@ -37,9 +37,9 @@ in
     networking.firewall.allowedTCPPorts = [
       cfg.mosquittoPort
       cfg.zigbee2mqttPort
-      8095
-      8097
-      5580
+      8095 # music-assistant
+      8097 # home-assistant
+      5580 # matter-server
     ];
   };
 }
diff --git a/modules/nixos/homeassistant/services/music-assistant/default.nix b/modules/nixos/homeassistant/services/music-assistant/default.nix
index 2139696..63c2118 100644
--- a/modules/nixos/homeassistant/services/music-assistant/default.nix
+++ b/modules/nixos/homeassistant/services/music-assistant/default.nix
@@ -65,9 +65,18 @@ in
       };
     };
 
+    users.users.music-assistant = {
+      isSystemUser = true;
+      group = "music-assistant";
+      home = "/var/lib/music-assistant";
+    };
+    users.groups.music-assistant = { };
+
     systemd.services.music-assistant.serviceConfig = {
       DynamicUser = lib.mkForce false;
       StateDirectory = "music-assistant";
+      user = config.users.users.music-assistant.name;
+      group = config.users.users.music-assistant.group;
     };
   };
 }