diff --git a/nixos/modules/services/logging/logrotate.nix b/nixos/modules/services/logging/logrotate.nix
index 6fb5f0588d97..8584563d881d 100644
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@@ -260,6 +260,8 @@ in
         # hardening
         CapabilityBoundingSet = [
           "CAP_CHOWN"
+          "CAP_DAC_OVERRIDE"
+          "CAP_SETUID"
           "CAP_SETGID"
         ];
         DevicePolicy = "closed";
@@ -280,16 +282,16 @@ in
         ProtectSystem = "full";
         RestrictNamespaces = true;
         RestrictRealtime = true;
-        RestrictSUIDSGID = true;
+        RestrictSUIDSGID = false; # can create sgid directories
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "@system-service"
+          "@system-service @setuid"
           "~@privileged @resources"
           "@chown"
         ];
         UMask = "0027";
       } // lib.optionalAttrs (!cfg.allowNetworking) {
-        PrivateNetwork = true;
+        PrivateNetwork = true; # e.g. mail delivery
         RestrictAddressFamilies = "none";
       };
     };