diff --git a/config/services/named.nix b/config/services/named.nix
index 8a0d1506..13ada0c1 100644
--- a/config/services/named.nix
+++ b/config/services/named.nix
@@ -82,5 +82,5 @@ in
     bindURI = "http://${internalIP.listenIP}:8653/";
     listenAddress = internalIP.listenIP;
   };
-  sops.secrets."services/dns/named-keys" = { };
+  sops.secrets."services/dns/named-keys" = { owner = "named"; };
 }