diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
index 43ffc85..14e4a16 100644
--- a/services/vaultwarden.nix
+++ b/services/vaultwarden.nix
@@ -41,6 +41,16 @@ in {
   config = mkIf cfg.enable {
     services.postgresql = {
       enable = true;
+
+      ensureDatabases = ["vaultwarden"];
+      ensureUsers = [
+        {
+          name = "vaultwarden";
+          ensurePermissions = {
+            "DATABASE vaultwarden" = "ALL PRIVILEGES";
+          };
+        }
+      ];
     };
 
     services.postgresqlBackup = {