diff --git a/modules/nixos/services/arr.nix b/modules/nixos/services/arr.nix
index 85e96f9..1a3361f 100644
--- a/modules/nixos/services/arr.nix
+++ b/modules/nixos/services/arr.nix
@@ -10,22 +10,33 @@
 
   config = lib.mkIf (config.arrServer != null) {
 
-    services.sonarr.enable = true;
-    services.radarr.enable = true;
-    services.bazarr.enable = true;
-    services.prowlarr.enable = true;
-    services.sabnzbd.enable = true;
-    services.sabnzbd.configFile = "/data/downloads/sabnzbd/sabnzbd.ini";
-    services.jellyseerr.enable = true;
-    unfreePackages = [ "unrar" ]; # Required for sabnzbd
+    services = {
+      bazarr = {
+        enable = true;
+        group = "media";
+      };
+      jellyseerr.enable = true;
+      prowlarr.enable = true;
+      sabnzbd = {
+        enable = true;
+        group = "media";
+        configFile = "/data/downloads/sabnzbd/sabnzbd.ini";
+      };
+      sonarr = {
+        enable = true;
+        group = "media";
+      };
+      radarr = {
+        enable = true;
+        group = "media";
+      };
+    };
 
-    # Grant users access to destination directories
-    users.users.sonarr.extraGroups = [ "jellyfin" "sabnzbd" ];
-    users.users.radarr.extraGroups = [ "jellyfin" "sabnzbd" ];
-    users.users.bazarr.extraGroups = [ "jellyfin" "sabnzbd" ];
+    users.groups.media = { };
+    users.users.${config.user}.extraGroups = [ "media" ];
     users.users.sabnzbd.homeMode = "0770";
-    users.users.${config.user}.extraGroups = [ "sabnzbd" ];
-    users.users.jellyfin.extraGroups = [ "sonarr" "radarr" ];
+
+    unfreePackages = [ "unrar" ]; # Required for sabnzbd
 
     # Requires updating the base_url config value in each service
     # If you try to rewrite the URL, the service won't redirect properly
diff --git a/modules/nixos/services/jellyfin.nix b/modules/nixos/services/jellyfin.nix
index a16c4f6..9501e15 100644
--- a/modules/nixos/services/jellyfin.nix
+++ b/modules/nixos/services/jellyfin.nix
@@ -11,10 +11,8 @@
   config = lib.mkIf (config.streamServer != null) {
 
     services.jellyfin.enable = true;
-    users.users.jellyfin = {
-      isSystemUser = true;
-      group = "jellyfin";
-    };
+    services.jellyfin.group = "media";
+    users.users.jellyfin = { isSystemUser = true; };
 
     caddy.routes = [{
       match = [{ host = [ config.streamServer ]; }];
@@ -24,13 +22,10 @@
       }];
     }];
 
-    # Grant user access to Jellyfin directories
-    users.users.${config.user}.extraGroups = [ "jellyfin" ];
-
     # Create videos directory, allow anyone in Jellyfin group to manage it
     systemd.tmpfiles.rules = [
-      "d /var/lib/jellyfin 0775 jellyfin jellyfin"
-      "d /var/lib/jellyfin/library 0775 jellyfin jellyfin"
+      "d /var/lib/jellyfin 0775 jellyfin media"
+      "d /var/lib/jellyfin/library 0775 jellyfin media"
     ];
 
     # Enable VA-API for hardware transcoding