diff --git a/nixos/modules/services/misc/ntfy-sh.nix b/nixos/modules/services/misc/ntfy-sh.nix
index 3dc3bd616c0..d66b47a2d68 100644
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@@ -19,6 +19,18 @@ in
       description = mdDoc "The ntfy.sh package to use.";
     };
 
+    user = mkOption {
+      default = "ntfy-sh";
+      type = types.str;
+      description = lib.mdDoc "User the ntfy-sh server runs under.";
+    };
+
+    group = mkOption {
+      default = "ntfy-sh";
+      type = types.str;
+      description = lib.mdDoc "Primary group of ntfy-sh user.";
+    };
+
     settings = mkOption {
       type = types.submodule { freeformType = settingsFormat.type; };
 
@@ -49,9 +61,6 @@ in
 
       services.ntfy-sh.settings = {
         auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
-        listen-http = mkDefault "127.0.0.1:2586";
-        attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";
-        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
 
       systemd.services.ntfy-sh = {
@@ -61,15 +70,10 @@ in
         after = [ "network.target" ];
 
         serviceConfig = {
-          ExecStartPre = [
-            "${pkgs.coreutils}/bin/touch ${cfg.settings.auth-file}"
-            "${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.attachment-cache-dir}"
-            "${pkgs.coreutils}/bin/touch ${cfg.settings.cache-file}"
-          ];
           ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
+          User = cfg.user;
           StateDirectory = "ntfy-sh";
 
-          DynamicUser = true;
           AmbientCapabilities = "CAP_NET_BIND_SERVICE";
           PrivateTmp = true;
           NoNewPrivileges = true;
@@ -84,8 +88,17 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           MemoryDenyWriteExecute = true;
-          # Upstream Requirements
-          LimitNOFILE = 20500;
+        };
+      };
+
+      users.groups = optionalAttrs (cfg.group == "ntfy-sh") {
+        ntfy-sh = { };
+      };
+
+      users.users = optionalAttrs (cfg.user == "ntfy-sh") {
+        ntfy-sh = {
+          isSystemUser = true;
+          group = cfg.group;
         };
       };
     };
diff --git a/nixos/tests/ntfy-sh.nix b/nixos/tests/ntfy-sh.nix
index fb29a78134f..4492fb44ced 100644
--- a/nixos/tests/ntfy-sh.nix
+++ b/nixos/tests/ntfy-sh.nix
@@ -19,7 +19,5 @@ import ./make-test-python.nix {
     notif = json.loads(machine.succeed("curl -s localhost:80/test/json?poll=1"))
 
     assert msg == notif["message"], "Wrong message"
-
-    machine.succeed("ntfy user list")
   '';
 }