diff --git a/machines/kcnhub/servers/gitea.nix b/machines/kcnhub/servers/gitea.nix
index dac3e3c..f6ca0ce 100644
--- a/machines/kcnhub/servers/gitea.nix
+++ b/machines/kcnhub/servers/gitea.nix
@@ -20,6 +20,9 @@ in {
     };
   };
 
+  # To allow gitea to access /etc/shadow for PAM authentication
+  users.users.gitea.extraGroups = [ "shadow" ];
+
   # Services Runner running in nixos-container w/ host label
   # This allows sharing of nix-store for caching actions builds
   # ... Maybe I'll actually set this up. Some concern for clearing its