diff --git a/config/hosts/matrix/matrix-synapse.nix b/config/hosts/matrix/matrix-synapse.nix
index e409805..e574a59 100644
--- a/config/hosts/matrix/matrix-synapse.nix
+++ b/config/hosts/matrix/matrix-synapse.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 {
   services.matrix-synapse = {
@@ -48,6 +48,8 @@
     ];
   };
 
+  systemd.services.matrix-synapse.serviceConfig.ReadWritePaths = [ config.services.matrix-synapse.settings.media_store_path ];
+
   deployment.keys = {
     "matrix-registration-shared-secret.secret" = {
       keyCommand = [ "pass" "noc/vm-secrets/chaosknoten/matrix/registration-shared-secret" ];