diff --git a/hosts/tsuki/services/jupyter.nix b/hosts/tsuki/services/jupyter.nix
index 573ed38..0e9da24 100644
--- a/hosts/tsuki/services/jupyter.nix
+++ b/hosts/tsuki/services/jupyter.nix
@@ -8,7 +8,6 @@ in {
   };
 
   users.users."jupyter".group = "jupyter";
-  users.groups."jupyter".members = [ "nginx" ];
 
   services.jupyter = {
     enable = true;
@@ -95,4 +94,16 @@ in {
       '';
     };
   };
+
+  local.socketActivation.jupyter = {
+    enable = cfg.enable;
+    originalSocketAddress = "/run/jupyter/jupyter.sock";
+    newSocketAddress = "/run/jupyter.sock";
+    privateNamespace = false;
+  };
+
+  systemd.services.jupyter-proxy.serviceConfig = {
+    User = "jupyter";
+    Group = "jupyter";
+  };
 }
diff --git a/hosts/tsuki/services/nginx/default.nix b/hosts/tsuki/services/nginx/default.nix
index c70eedc..add2090 100644
--- a/hosts/tsuki/services/nginx/default.nix
+++ b/hosts/tsuki/services/nginx/default.nix
@@ -50,7 +50,7 @@
       "hydra".servers."localhost:${s srv.hydra.port}" = { };
       "idrac".servers."${ips.idrac}" = { };
       "invidious".servers."localhost:${s config.services.invidious.port}" = { };
-      "jupyter".servers."unix:/run/jupyter/jupyter.sock" = { };
+      "jupyter".servers."unix:${sa.jupyter.newSocketAddress}" = { };
       "kanidm".servers."localhost:8300" = { };
       "navidrome".servers."unix:${sa.navidrome.newSocketAddress}" = { };
       "osuchan".servers."localhost:${s ports.osuchan}" = { };