diff --git a/hosts/hetzner-arm/profiles/photoprism.nix b/hosts/hetzner-arm/profiles/photoprism.nix
index e4dd0c9..b276c28 100644
--- a/hosts/hetzner-arm/profiles/photoprism.nix
+++ b/hosts/hetzner-arm/profiles/photoprism.nix
@@ -72,19 +72,27 @@ in {
 
   services.photoprism = {
     enable = true;
-    originalsPath = "/Photos";
+    originalsPath = "/Photos/originals";
     settings = {
       PHOTOPRISM_SITE_URL = "https://photoprism.owo.monster";
-      PHOTOPRISM_DISABLE_PLACES = "true";
+      PHOTOPRISM_SITE_TITLE = "PhotoPrism";
+
+      PHOTOPRISM_SIDECAR_PATH = "/Photos/sidecar";
+
       PHOTOPRISM_DISABLE_TENSORFLOW = "true";
+      PHOTOPRISM_DISABLE_PLACES = "true";
       PHOTOPRISM_DETECT_NSFW = "false";
       PHOTOPRISM_UPLOAD_NSFW = "true";
       PHOTOPRISM_DISABLE_FACES = "true";
       PHOTOPRISM_DISABLE_CLASSIFICATION = "true";
-      PHOTOPRISM_SITE_TITLE = "PhotoPrism";
     };
   };
 
+  systemd.services.photoprism.serviceConfig = {
+    DynamicUser = false;
+    ReadWritePaths = [ "/Photos" ];
+  };
+
   services.nginx.virtualHosts."photoprism.owo.monster" = {
     forceSSL = true;
     enableACME = true;