diff --git a/hosts/best/cache/default.nix b/hosts/best/cache/default.nix
index 54ba52b..0ae8afb 100644
--- a/hosts/best/cache/default.nix
+++ b/hosts/best/cache/default.nix
@@ -10,7 +10,7 @@ in {
 
   secrets.nixServeKey = {
     file  = ./key.age;
-    owner = "nix-serve";
+    owner = "root"; # `nix-serve` runs as root.
   };
 
   services.nix-serve = enabled {