diff --git a/config/lnbits.nix b/config/lnbits.nix
index d1ad25b..17f6ea1 100644
--- a/config/lnbits.nix
+++ b/config/lnbits.nix
@@ -103,17 +103,26 @@ in
   # This will DELETE any extensions installed via the LNBits UI.
   #
   # Option 1: Replace extensions directory entirely (use with caution)
+  # Create symlink and fix ownership of deployed extensions
   systemd.tmpfiles.rules = [
-    # Set permissions on source directory so lnbits user can read it
-    "d /var/src/lnbits-extensions 0755 lnbits lnbits - -"
-    # Create symlink with proper ownership
     "L+ /var/lib/lnbits/extensions - lnbits lnbits - /var/src/lnbits-extensions"
   ];
+
+  # Fix ownership of deployed extensions (krops deploys as root:root)
+  systemd.services.lnbits-fix-extensions-ownership = {
+    description = "Fix ownership of deployed LNBits extensions";
+    before = [ "lnbits.service" ];
+    wantedBy = [ "lnbits.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.coreutils}/bin/chown -R lnbits:lnbits /var/src/lnbits-extensions";
+    };
+  };
   #
   # Option 2: Manually merge deployed extensions with existing ones
   # Copy deployed extensions into the extensions directory without replacing it:
   # systemd.tmpfiles.rules = [
-  #   "d /var/src/lnbits-extensions 0755 lnbits lnbits - -"
+  #   "d /var/src/lnbits-extensions 0755 root root - -"
   # ];
   # systemd.services.lnbits-copy-extensions = {
   #   description = "Copy deployed LNBits extensions";
@@ -121,7 +130,7 @@ in
   #   wantedBy = [ "lnbits.service" ];
   #   serviceConfig = {
   #     Type = "oneshot";
-  #     ExecStart = "${pkgs.rsync}/bin/rsync -av /var/src/lnbits-extensions/ /var/lib/lnbits/extensions/";
+  #     ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.rsync}/bin/rsync -av /var/src/lnbits-extensions/ /var/lib/lnbits/extensions/ && ${pkgs.coreutils}/bin/chown -R lnbits:lnbits /var/lib/lnbits/extensions/'";
   #   };
   # };
 }