diff --git a/hosts/pinwheel/modules/music/default.nix b/hosts/pinwheel/modules/music/default.nix
index 194527d..2afd9de 100644
--- a/hosts/pinwheel/modules/music/default.nix
+++ b/hosts/pinwheel/modules/music/default.nix
@@ -54,4 +54,17 @@ in
       ExecStart = "${pkgs.playerctl}/bin/playerctld";
     };
   };
+
+  # Ensure the parent dir of the secret's path is owned by alex; otherwise
+  # agenix creates it as root.
+  systemd.tmpfiles.rules = [
+    "d /home/alex/.config/naviterm 0755 alex users -"
+  ];
+
+  age.secrets."naviterm-config" = {
+    file = ../../../../secrets/pinwheel/naviterm-config.age;
+    path = "/home/alex/.config/naviterm/config.ini";
+    owner = "alex";
+    group = "users";
+  };
 }
diff --git a/hosts/pinwheel/modules/syncthing/default.nix b/hosts/pinwheel/modules/syncthing/default.nix
index 63d2d2c..23800ad 100644
--- a/hosts/pinwheel/modules/syncthing/default.nix
+++ b/hosts/pinwheel/modules/syncthing/default.nix
@@ -69,6 +69,13 @@
     };
   };
 
+  # Ensure dataDir is owned by the syncthing user; otherwise the module creates it
+  # as root when making configDir (dataDir/.config/syncthing) on a fresh machine.
+  systemd.tmpfiles.rules = [
+    "d /home/alex/sync 0755 alex users -"
+    "d /home/alex/sync/.config 0755 alex users -"
+  ];
+
   age = {
     secrets = {
       "syncthing-cert".file = ../../../../secrets/pinwheel/syncthing-cert.age;