diff --git a/nixos/modules/services/web-apps/mobilizon.nix b/nixos/modules/services/web-apps/mobilizon.nix
index 35efbeb767d6..77a19e60a074 100644
--- a/nixos/modules/services/web-apps/mobilizon.nix
+++ b/nixos/modules/services/web-apps/mobilizon.nix
@@ -398,7 +398,10 @@ in
     };
 
     systemd.tmpfiles.rules = [
+      "d /var/lib/mobilizon 700 mobilizon mobilizon - -"
       "d /var/lib/mobilizon/sitemap 700 mobilizon mobilizon - -"
+      "d /var/lib/mobilizon/uploads 700 mobilizon mobilizon - -"
+      "d /var/lib/mobilizon/uploads/exports 700 mobilizon mobilizon - -"
       "d /var/lib/mobilizon/uploads/exports/csv 700 mobilizon mobilizon - -"
       "Z /var/lib/mobilizon 700 mobilizon mobilizon - -"
     ];
diff --git a/nixos/tests/mobilizon.nix b/nixos/tests/mobilizon.nix
index 1a07c5fc2732..5800ac702f16 100644
--- a/nixos/tests/mobilizon.nix
+++ b/nixos/tests/mobilizon.nix
@@ -43,5 +43,11 @@ in
     server.wait_for_unit("mobilizon.service")
     server.wait_for_open_port(${toString port})
     server.succeed("curl --fail https://${mobilizonDomain}/")
+
+    # Verify ownership is set up correctly
+    owner = server.succeed("stat -c '%U' /var/lib/mobilizon/sitemap").rstrip()
+    assert owner == "mobilizon", f"unexpected owner: {owner}"
+    owner = server.succeed("stat -c '%U' /var/lib/mobilizon/uploads").rstrip()
+    assert owner == "mobilizon", f"unexpected owner: {owner}"
   '';
 }