diff --git a/configs/nixos/guests/copyparty.nix b/configs/nixos/guests/copyparty.nix
index 4b79572..ac5dffb 100644
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -111,7 +111,14 @@ in
             readOnly = true;
           };
         }
-        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes;
+        // lib.mapAttrs' (_urlPath: volume:
+          lib.nameValuePair volume.path {
+            directory = volume.hostPath;
+            owner = "root";
+            group = "storage";
+            mode = "2770";
+          }
+        ) cfg.volumes;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";
diff --git a/configs/nixos/modules/services/copyparty.nix b/configs/nixos/modules/services/copyparty.nix
index 3ce41ff..fd04482 100644
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -34,7 +34,13 @@ let
 
   renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
 
-  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") flags;
+  hasFlag = name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+
+  defaultPermissionFlags = flags:
+    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
+    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
+
+  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
 
   renderVolume = urlPath: volume: ''
     [${urlPath}]