diff --git a/lib/module/default.nix b/lib/module/default.nix
index 3f8b4f3..904a13f 100644
--- a/lib/module/default.nix
+++ b/lib/module/default.nix
@@ -354,4 +354,38 @@ with lib; rec {
   ## @return               The host name where the service is defined.
   resolveServiceHost = networkServices: serviceName:
     (flattenHostServices networkServices).${serviceName}.host;
+
+  ## Create an impermanence persistence directory owned by a service user.
+  ##
+  ## ```nix
+  ## mkPersistDir config "forgejo" "/var/lib/forgejo"
+  ## mkPersistDir config "forgejo" "/var/lib/forgejo" "700"
+  ## ```
+  ##
+  ## @param config    The module config (passed from the module).
+  ## @param username  The service username (must exist in config.users.users).
+  ## @param directory The directory path to persist.
+  ## @param mode      Permissions mode (default: "700").
+  ## @return An attrset for the impermanence.folders list.
+  mkPersistDir = config: username: directory: mode ? "700": let
+    u = config.users.users.${username};
+  in {
+    user = u.name;
+    group = u.group;
+    inherit directory mode;
+  };
+
+  ## Create an impermanence persistence directory owned by root.
+  ##
+  ## ```nix
+  ## mkPersistRootDir "/var/lib/docker"
+  ## mkPersistRootDir "/var/lib/docker" "700"
+  ## ```
+  ##
+  ## @param directory The directory path to persist.
+  ## @param mode      Permissions mode (default: "700").
+  ## @return An attrset for the impermanence.folders list.
+  mkPersistRootDir = directory: mode ? "700": {
+    inherit directory mode;
+  };
 }
diff --git a/modules/nixos/desktop/apps/games/minecraft/default.nix b/modules/nixos/desktop/apps/games/minecraft/default.nix
index b70a133..4e6f30b 100644
--- a/modules/nixos/desktop/apps/games/minecraft/default.nix
+++ b/modules/nixos/desktop/apps/games/minecraft/default.nix
@@ -7,7 +7,7 @@
   ...
 }: let
   inherit (lib) types mkIf mkEnableOption mkOption mapAttrs mapAttrsToList flatten;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkOpt mkOptAttrset;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkOpt mkOptAttrset mkPersistRootDir;
   base = "${namespace}.desktop.apps.games.minecraft";
   cfg = getAttrByNamespace config base;
 in {
@@ -48,6 +48,8 @@ in {
         });
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/srv/minecraft"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/srv/minecraft")
+    ];
   };
 }
diff --git a/modules/nixos/desktop/apps/games/terraria/default.nix b/modules/nixos/desktop/apps/games/terraria/default.nix
index ae81a54..557070f 100644
--- a/modules/nixos/desktop/apps/games/terraria/default.nix
+++ b/modules/nixos/desktop/apps/games/terraria/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption types;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkOpt mkNullableOpt;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkOpt mkNullableOpt mkPersistRootDir;
   base = "${namespace}.desktop.apps.games.terraria";
   cfg = getAttrByNamespace config base;
 in {
@@ -31,6 +31,8 @@ in {
       port = cfg.port;
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/srv/terraria"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/srv/terraria")
+    ];
   };
 }
diff --git a/modules/nixos/desktop/apps/teamviewer/default.nix b/modules/nixos/desktop/apps/teamviewer/default.nix
index 30a38c4..f9209ab 100644
--- a/modules/nixos/desktop/apps/teamviewer/default.nix
+++ b/modules/nixos/desktop/apps/teamviewer/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace enabled;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace enabled mkPersistRootDir;
   base = "${namespace}.desktop.apps.teamviewer";
   cfg = getAttrByNamespace config base;
 in {
@@ -19,6 +19,8 @@ in {
 
     services.teamviewer = enabled;
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/teamviewer"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/var/lib/teamviewer")
+    ];
   };
 }
diff --git a/modules/nixos/desktop/env/greetd/default.nix b/modules/nixos/desktop/env/greetd/default.nix
index ad7b226..a91a1f3 100644
--- a/modules/nixos/desktop/env/greetd/default.nix
+++ b/modules/nixos/desktop/env/greetd/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkPersistDir;
   base = "${namespace}.desktop.env.greetd";
   cfg = getAttrByNamespace config base;
 in {
@@ -25,6 +25,8 @@ in {
       '';
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/cache/tuigreet"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "greeter" "/var/cache/tuigreet")
+    ];
   };
 }
diff --git a/modules/nixos/hardware/bluetooth/default.nix b/modules/nixos/hardware/bluetooth/default.nix
index 7369aa4..dbe84bd 100644
--- a/modules/nixos/hardware/bluetooth/default.nix
+++ b/modules/nixos/hardware/bluetooth/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkPersistRootDir;
   base = "${namespace}.hardware.bluetooth";
   cfg = getAttrByNamespace config base;
 in {
@@ -21,6 +21,8 @@ in {
       powerOnBoot = true;
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/bluetooth"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/var/lib/bluetooth")
+    ];
   };
 }
diff --git a/modules/nixos/hardware/fingerprint/default.nix b/modules/nixos/hardware/fingerprint/default.nix
index c0ebff8..67fa15a 100644
--- a/modules/nixos/hardware/fingerprint/default.nix
+++ b/modules/nixos/hardware/fingerprint/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkPersistRootDir;
   base = "${namespace}.hardware.fingerprint";
   cfg = getAttrByNamespace config base;
 in {
@@ -18,6 +18,8 @@ in {
       enable = true;
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/fprint"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/var/lib/fprint")
+    ];
   };
 }
diff --git a/modules/nixos/services/apps/asciinema/default.nix b/modules/nixos/services/apps/asciinema/default.nix
index d52d895..4586213 100644
--- a/modules/nixos/services/apps/asciinema/default.nix
+++ b/modules/nixos/services/apps/asciinema/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkForce;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveDatabaseHost resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveDatabaseHost resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -49,12 +49,7 @@ in {
     sops.secrets."environment-file/asciinema" = {};
 
     ${namespace}.services.storage.impermanence.folders = [
-      {
-        directory = "/var/lib/asciinema";
-        user = "asciinema";
-        group = "asciinema";
-        mode = "700";
-      }
+      (mkPersistDir config "asciinema" "/var/lib/asciinema")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/forgejo/default.nix b/modules/nixos/services/apps/forgejo/default.nix
index faa045a..9ad105d 100644
--- a/modules/nixos/services/apps/forgejo/default.nix
+++ b/modules/nixos/services/apps/forgejo/default.nix
@@ -105,6 +105,8 @@ in {
 
     sops.secrets."forgejo/db" = {};
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/forgejo"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "forgejo" "/var/lib/forgejo")
+    ];
   };
 }
diff --git a/modules/nixos/services/apps/ignis/default.nix b/modules/nixos/services/apps/ignis/default.nix
index d33be87..d7b3efd 100644
--- a/modules/nixos/services/apps/ignis/default.nix
+++ b/modules/nixos/services/apps/ignis/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -111,7 +111,7 @@ in {
     networking.firewall.allowedTCPPorts = [port];
 
     ${namespace}.services.storage.impermanence.folders = [
-      "/var/lib/ignis"
+      (mkPersistDir config "ignis" "/var/lib/ignis")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/immich/default.nix b/modules/nixos/services/apps/immich/default.nix
index 825c2c6..bbcd54c 100644
--- a/modules/nixos/services/apps/immich/default.nix
+++ b/modules/nixos/services/apps/immich/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   pgCfg = getAttrByNamespace config "${namespace}.services.storage.postgresql";
@@ -44,15 +44,8 @@ in {
 
     sops.secrets."environment-file/immich" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      immichUser = config.users.users.immichUser;
-    in [
-      {
-        directory = "/var/lib/immich";
-        user = immichUser.name;
-        group = immichUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "immich" "/var/lib/immich")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/miasma/default.nix b/modules/nixos/services/apps/miasma/default.nix
index 3c8a803..343c5ce 100644
--- a/modules/nixos/services/apps/miasma/default.nix
+++ b/modules/nixos/services/apps/miasma/default.nix
@@ -26,15 +26,15 @@ in {
     systemd.services.miasma = {
       description = "Trap AI web scrapers in an endless poison pit";
       wantedBy = ["multi-user.target"];
-      serviceConfig = let
-        miasmaUser = config.users.users.miasma;
-      in {
+        serviceConfig = let
+          inherit (config.users.users) miasma;
+        in {
         Type = "simple";
         Restart = "always";
         RestartSec = 1;
 
-        User = miasmaUser.name;
-        Group = miasmaUser.group;
+          User = miasma.name;
+          Group = miasma.group;
 
         StateDirectory = "miasma";
         ReadWritePaths = "/var/lib/miasma";
diff --git a/modules/nixos/services/apps/prometheus/default.nix b/modules/nixos/services/apps/prometheus/default.nix
index dc2a196..2d887b8 100644
--- a/modules/nixos/services/apps/prometheus/default.nix
+++ b/modules/nixos/services/apps/prometheus/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -20,7 +20,7 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = [
-      "/var/lib/prometheus2"
+      (mkPersistDir config "prometheus" "/var/lib/prometheus2")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/qbittorrent/default.nix b/modules/nixos/services/apps/qbittorrent/default.nix
index 9875db8..1fb1707 100644
--- a/modules/nixos/services/apps/qbittorrent/default.nix
+++ b/modules/nixos/services/apps/qbittorrent/default.nix
@@ -7,7 +7,7 @@
   ...
 }: let
   inherit (lib) mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost hostHasService resolveServicePort resolveDatabaseIP;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost hostHasService resolveServicePort resolveDatabaseIP mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -230,22 +230,9 @@ in {
       "qui" = {};
     };
 
-    ${namespace}.services.storage.impermanence.folders = let
-      qbittorrentUser = config.users.users.qbittorrent;
-      quiUser = config.users.users.qui;
-    in [
-      {
-        directory = "/var/lib/qBittorrent";
-        user = qbittorrentUser.name;
-        group = qbittorrentUser.group;
-        mode = "770";
-      }
-      {
-        directory = "/var/lib/qui";
-        user = quiUser.name;
-        group = quiUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "qbittorrent" "/var/lib/qBittorrent")
+      (mkPersistDir config "qui" "/var/lib/qui")
     ];
 
     networking = {
diff --git a/modules/nixos/services/apps/rustypaste/default.nix b/modules/nixos/services/apps/rustypaste/default.nix
index b3eb550..7f4e763 100644
--- a/modules/nixos/services/apps/rustypaste/default.nix
+++ b/modules/nixos/services/apps/rustypaste/default.nix
@@ -7,7 +7,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort mkPersistDir;
   inherit (config.users) users groups;
   inherit (config.sops) secrets;
   inherit (config.networking) hostName;
@@ -74,6 +74,8 @@ in {
 
     networking.firewall.allowedTCPPorts = [port];
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/rustypaste"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "rustypaste" "/var/lib/rustypaste")
+    ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/autobrr/default.nix b/modules/nixos/services/apps/servarr/autobrr/default.nix
index 23f1920..b7730bb 100644
--- a/modules/nixos/services/apps/servarr/autobrr/default.nix
+++ b/modules/nixos/services/apps/servarr/autobrr/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -45,7 +45,7 @@ in {
       };
 
       services.autobrr = let
-        autobrrUser = config.users.users.autobrr;
+        inherit (config.users.users) autobrr;
       in
         mkMerge [
           {
@@ -54,8 +54,8 @@ in {
             ];
             serviceConfig = {
               DynamicUser = mkForce false;
-              User = autobrrUser.name;
-              Group = autobrrUser.group;
+              User = autobrr.name;
+              Group = autobrr.group;
               UMask = mkForce "0002";
               EnvironmentFile = config.sops.secrets."environment-file/autobrr".path;
             };
@@ -83,15 +83,8 @@ in {
       groups.autobrr = {};
     };
 
-    ${namespace}.services.storage.impermanence.folders = let
-      autobrrUser = config.users.users.autobrr;
-    in [
-      {
-        directory = "/var/lib/autobrr";
-        user = autobrrUser.name;
-        group = autobrrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "autobrr" "/var/lib/autobrr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/bazarr/default.nix b/modules/nixos/services/apps/servarr/bazarr/default.nix
index 24f14ae..2c5bac0 100644
--- a/modules/nixos/services/apps/servarr/bazarr/default.nix
+++ b/modules/nixos/services/apps/servarr/bazarr/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -22,7 +22,7 @@ in {
     };
 
     systemd.services.bazarr = let
-      bazarrUser = config.users.users.bazarr;
+      inherit (config.users.users) bazarr;
       dbIp = resolveDatabaseIP networkCfg.devices pgCfg.databases "bazarr";
     in
       mkMerge [
@@ -37,8 +37,8 @@ in {
 
           serviceConfig = {
             DynamicUser = mkForce false;
-            User = bazarrUser.name;
-            Group = bazarrUser.group;
+            User = bazarr.name;
+            Group = bazarr.group;
             UMask = mkForce "0002";
             EnvironmentFile = config.sops.secrets."environment-file/bazarr".path;
           };
@@ -62,15 +62,8 @@ in {
 
     sops.secrets."environment-file/bazarr" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      bazarrUser = config.users.users.bazarr;
-    in [
-      {
-        directory = "/var/lib/bazarr";
-        user = bazarrUser.name;
-        group = bazarrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "bazarr" "/var/lib/bazarr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/jellyfin/default.nix b/modules/nixos/services/apps/servarr/jellyfin/default.nix
index 0e97288..da13529 100644
--- a/modules/nixos/services/apps/servarr/jellyfin/default.nix
+++ b/modules/nixos/services/apps/servarr/jellyfin/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -50,15 +50,8 @@ in {
       LIBVA_DRIVER_NAME = "radeonsi";
     };
 
-    ${namespace}.services.storage.impermanence.folders = let
-      jellyfinUser = config.users.users.jellyfin;
-    in [
-      {
-        directory = "/var/lib/jellyfin";
-        user = jellyfinUser.name;
-        group = jellyfinUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "jellyfin" "/var/lib/jellyfin")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/lidarr/default.nix b/modules/nixos/services/apps/servarr/lidarr/default.nix
index 7f0249b..7b70fca 100644
--- a/modules/nixos/services/apps/servarr/lidarr/default.nix
+++ b/modules/nixos/services/apps/servarr/lidarr/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -36,14 +36,14 @@ in {
     };
 
     systemd.services.lidarr = let
-      lidarrUser = config.users.users.lidarr;
+      inherit (config.users.users) lidarr;
     in
       mkMerge [
         {
           serviceConfig = {
             DynamicUser = mkForce false;
-            User = lidarrUser.name;
-            Group = lidarrUser.group;
+            User = lidarr.name;
+            Group = lidarr.group;
             UMask = mkForce "0002";
           };
         }
@@ -66,15 +66,8 @@ in {
 
     sops.secrets."environment-file/lidarr" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      lidarrUser = config.users.users.lidarr;
-    in [
-      {
-        directory = "/var/lib/lidarr";
-        user = lidarrUser.name;
-        group = lidarrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "lidarr" "/var/lib/lidarr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/ombi/default.nix b/modules/nixos/services/apps/servarr/ombi/default.nix
index e7972e9..1b31453 100644
--- a/modules/nixos/services/apps/servarr/ombi/default.nix
+++ b/modules/nixos/services/apps/servarr/ombi/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -29,15 +29,8 @@ in {
       groups.ombi = {};
     };
 
-    ${namespace}.services.storage.impermanence.folders = let
-      ombiUser = config.users.users.ombi;
-    in [
-      {
-        directory = "/var/lib/ombi";
-        user = ombiUser.name;
-        group = ombiUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "ombi" "/var/lib/ombi")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/prowlarr/default.nix b/modules/nixos/services/apps/servarr/prowlarr/default.nix
index 81e5821..350a418 100644
--- a/modules/nixos/services/apps/servarr/prowlarr/default.nix
+++ b/modules/nixos/services/apps/servarr/prowlarr/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -36,14 +36,14 @@ in {
     };
 
     systemd.services.prowlarr = let
-      prowlarrUser = config.users.users.prowlarr;
+      inherit (config.users.users) prowlarr;
     in
       mkMerge [
         {
           serviceConfig = {
             DynamicUser = mkForce false;
-            User = prowlarrUser.name;
-            Group = prowlarrUser.group;
+            User = prowlarr.name;
+            Group = prowlarr.group;
             UMask = mkForce "0002";
           };
         }
@@ -66,15 +66,8 @@ in {
 
     sops.secrets."environment-file/prowlarr" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      prowlarrUser = config.users.users.prowlarr;
-    in [
-      {
-        directory = "/var/lib/prowlarr";
-        user = prowlarrUser.name;
-        group = prowlarrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "prowlarr" "/var/lib/prowlarr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/radarr/default.nix b/modules/nixos/services/apps/servarr/radarr/default.nix
index 27cb864..a05d281 100644
--- a/modules/nixos/services/apps/servarr/radarr/default.nix
+++ b/modules/nixos/services/apps/servarr/radarr/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -36,14 +36,14 @@ in {
     };
 
     systemd.services.radarr = let
-      radarrUser = config.users.users.radarr;
+      inherit (config.users.users) radarr;
     in
       mkMerge [
         {
           serviceConfig = {
             DynamicUser = mkForce false;
-            User = radarrUser.name;
-            Group = radarrUser.group;
+            User = radarr.name;
+            Group = radarr.group;
             UMask = mkForce "0002";
           };
         }
@@ -66,15 +66,8 @@ in {
 
     sops.secrets."environment-file/radarr" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      radarrUser = config.users.users.radarr;
-    in [
-      {
-        directory = "/var/lib/radarr";
-        user = radarrUser.name;
-        group = radarrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "radarr" "/var/lib/radarr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/seerr/default.nix b/modules/nixos/services/apps/servarr/seerr/default.nix
index d0a2984..f5115c0 100644
--- a/modules/nixos/services/apps/servarr/seerr/default.nix
+++ b/modules/nixos/services/apps/servarr/seerr/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -23,7 +23,7 @@ in {
     };
 
     systemd.services.seerr = let
-      seerrUser = config.users.users.seerr;
+      inherit (config.users.users) seerr;
       dbIp = resolveDatabaseIP networkCfg.devices pgCfg.databases "seerr";
     in
       mkMerge [
@@ -38,8 +38,8 @@ in {
 
           serviceConfig = {
             DynamicUser = mkForce false;
-            User = seerrUser.name;
-            Group = seerrUser.group;
+            User = seerr.name;
+            Group = seerr.group;
             EnvironmentFile = config.sops.secrets."environment-file/seerr".path;
           };
         }
@@ -61,15 +61,8 @@ in {
 
     sops.secrets."environment-file/seerr" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      seerrUser = config.users.users.seerr;
-    in [
-      {
-        directory = "/var/lib/seerr";
-        user = seerrUser.name;
-        group = seerrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "seerr" "/var/lib/seerr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/sonarr/default.nix b/modules/nixos/services/apps/servarr/sonarr/default.nix
index 52c5df6..60b1ac1 100644
--- a/modules/nixos/services/apps/servarr/sonarr/default.nix
+++ b/modules/nixos/services/apps/servarr/sonarr/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkForce mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -36,14 +36,14 @@ in {
     };
 
     systemd.services.sonarr = let
-      sonarrUser = config.users.users.sonarr;
+      inherit (config.users.users) sonarr;
     in
       mkMerge [
         {
           serviceConfig = {
             DynamicUser = mkForce false;
-            User = sonarrUser.name;
-            Group = sonarrUser.group;
+            User = sonarr.name;
+            Group = sonarr.group;
             UMask = mkForce "0002";
           };
         }
@@ -66,15 +66,8 @@ in {
 
     sops.secrets."environment-file/sonarr" = {};
 
-    ${namespace}.services.storage.impermanence.folders = let
-      sonarrUser = config.users.users.sonarr;
-    in [
-      {
-        directory = "/var/lib/sonarr";
-        user = sonarrUser.name;
-        group = sonarrUser.group;
-        mode = "700";
-      }
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "sonarr" "/var/lib/sonarr")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/servarr/unpackerr/default.nix b/modules/nixos/services/apps/servarr/unpackerr/default.nix
index 0d59880..2161f24 100644
--- a/modules/nixos/services/apps/servarr/unpackerr/default.nix
+++ b/modules/nixos/services/apps/servarr/unpackerr/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) filter mkIf optional mapAttrs' nameValuePair toUpper;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService mkPersistDir;
   inherit (config.users.users) unpackerr;
   inherit (config.networking) hostName;
 
@@ -75,12 +75,7 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = [
-      {
-        directory = "/var/lib/unpackerr";
-        user = unpackerr.name;
-        group = unpackerr.group;
-        mode = "700";
-      }
+      (mkPersistDir config "unpackerr" "/var/lib/unpackerr")
     ];
 
     sops.secrets."environment-file/unpackerr" = {};
diff --git a/modules/nixos/services/apps/slurm/default.nix b/modules/nixos/services/apps/slurm/default.nix
index c816814..54356e9 100644
--- a/modules/nixos/services/apps/slurm/default.nix
+++ b/modules/nixos/services/apps/slurm/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) types mkEnableOption mkIf groupBy mapAttrsToList attrNames mapAttrs concatStringsSep flatten;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP mkOpt mkOptAttrset mkListOpt;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP mkOpt mkOptAttrset mkListOpt mkPersistDir;
   inherit (config.networking) hostName;
   base = "${namespace}.services.apps.slurm";
   cfg = getAttrByNamespace config base;
@@ -124,8 +124,8 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = [
-      "/var/spool/slurmctld"
-      "/var/spool/slurmd"
+      (mkPersistDir config "slurm" "/var/spool/slurmctld")
+      (mkPersistDir config "slurm" "/var/spool/slurmd")
     ];
   };
 }
diff --git a/modules/nixos/services/apps/uptime-kuma/default.nix b/modules/nixos/services/apps/uptime-kuma/default.nix
index bfba734..9549757 100644
--- a/modules/nixos/services/apps/uptime-kuma/default.nix
+++ b/modules/nixos/services/apps/uptime-kuma/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf mkForce;
-  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace hostHasService resolveServicePort mkPersistDir;
   inherit (config.users) users;
   inherit (config.networking) hostName;
 
@@ -43,6 +43,8 @@ in {
 
     networking.firewall.allowedTCPPorts = [port];
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/uptime-kuma"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "uptime-kuma" "/var/lib/uptime-kuma")
+    ];
   };
 }
diff --git a/modules/nixos/services/apps/vaultwarden/default.nix b/modules/nixos/services/apps/vaultwarden/default.nix
index e7b28ac..d340165 100644
--- a/modules/nixos/services/apps/vaultwarden/default.nix
+++ b/modules/nixos/services/apps/vaultwarden/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort;
+  inherit (lib.${namespace}) getAttrByNamespace resolveDatabaseHost resolveDatabaseIP hostHasService resolveServicePort mkPersistDir;
   inherit (config.networking) hostName;
 
   pgCfg = getAttrByNamespace config "${namespace}.services.storage.postgresql";
@@ -64,5 +64,9 @@ in {
     sops.secrets."vaultwarden" = {};
 
     networking.firewall.allowedTCPPorts = [port];
+
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "vaultwarden" "/var/lib/vaultwarden")
+    ];
   };
 }
diff --git a/modules/nixos/services/ci/github-runner/default.nix b/modules/nixos/services/ci/github-runner/default.nix
index 6de6948..bfdc435 100644
--- a/modules/nixos/services/ci/github-runner/default.nix
+++ b/modules/nixos/services/ci/github-runner/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) types mkEnableOption mkOption mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkOpt mkRequiredOpt mkNullableOpt mkOptAttrset;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkOpt mkRequiredOpt mkNullableOpt mkOptAttrset mkPersistDir;
   inherit (config.networking) hostName;
   inherit (config.sops) secrets;
   base = "${namespace}.services.ci.github-runner";
@@ -102,6 +102,8 @@ in {
 
     sops.secrets."github/runner" = {};
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/github-runner"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistDir config "github-runner" "/var/lib/github-runner")
+    ];
   };
 }
diff --git a/modules/nixos/services/networking/network-manager/default.nix b/modules/nixos/services/networking/network-manager/default.nix
index a37dcbd..19fa94d 100644
--- a/modules/nixos/services/networking/network-manager/default.nix
+++ b/modules/nixos/services/networking/network-manager/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkEnableOption mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkPersistRootDir;
   base = "${namespace}.services.networking.network-manager";
   cfg = getAttrByNamespace config base;
 in {
@@ -19,6 +19,8 @@ in {
 
     networking.networkmanager.enable = true;
 
-    ${namespace}.services.storage.impermanence.folders = ["/etc/NetworkManager/system-connections"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/etc/NetworkManager/system-connections")
+    ];
   };
 }
diff --git a/modules/nixos/services/networking/tailscale/default.nix b/modules/nixos/services/networking/tailscale/default.nix
index 323b04a..45ef643 100644
--- a/modules/nixos/services/networking/tailscale/default.nix
+++ b/modules/nixos/services/networking/tailscale/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkPersistRootDir;
   base = "${namespace}.services.networking.tailscale";
   cfg = getAttrByNamespace config base;
 in {
@@ -19,6 +19,8 @@ in {
       useRoutingFeatures = "server";
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/tailscale"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/var/lib/tailscale")
+    ];
   };
 }
diff --git a/modules/nixos/services/security/acme/default.nix b/modules/nixos/services/security/acme/default.nix
index 07fdab1..167f405 100644
--- a/modules/nixos/services/security/acme/default.nix
+++ b/modules/nixos/services/security/acme/default.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   inherit (lib) mkIf;
-  inherit (lib.${namespace}) getAttrByNamespace isGateway;
+  inherit (lib.${namespace}) getAttrByNamespace isGateway mkPersistDir;
   inherit (config.networking) hostName;
 
   cfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -38,7 +38,7 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = [
-      "/var/lib/acme"
+      (mkPersistDir config "acme" "/var/lib/acme")
     ];
   };
 }
diff --git a/modules/nixos/services/storage/nfs/default.nix b/modules/nixos/services/storage/nfs/default.nix
index 2697104..156729d 100644
--- a/modules/nixos/services/storage/nfs/default.nix
+++ b/modules/nixos/services/storage/nfs/default.nix
@@ -5,7 +5,7 @@
   ...
 } @ args: let
   inherit (lib) types mkIf mkEnableOption mkMerge concatStringsSep;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP mkOpt mkRequiredOpt mkNullableOpt mkListOpt mkOptAttrset;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP mkOpt mkRequiredOpt mkNullableOpt mkListOpt mkOptAttrset mkPersistRootDir;
   base = "${namespace}.services.storage.nfs";
   cfg = getAttrByNamespace config base;
   networkCfg = getAttrByNamespace config "${namespace}.services.networking";
@@ -51,8 +51,8 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = mkMerge [
-      ["/var/lib/nfs"]
-      (mkIf (cfg.shares != []) (cfg.shares |> map (s: "/mnt/nfs/${s.name}")))
+      [ (mkPersistRootDir "/var/lib/nfs") ]
+      (mkIf (cfg.shares != []) (cfg.shares |> map (s: mkPersistRootDir "/mnt/nfs/${s.name}")))
     ];
 
     networking.firewall.allowedTCPPorts = [2049];
diff --git a/modules/nixos/services/storage/postgresql/default.nix b/modules/nixos/services/storage/postgresql/default.nix
index b09c096..23e0a26 100644
--- a/modules/nixos/services/storage/postgresql/default.nix
+++ b/modules/nixos/services/storage/postgresql/default.nix
@@ -7,7 +7,7 @@
   ...
 } @ args: let
   inherit (lib) types mkIf mkMerge concatStringsSep hasAttr getAttr filter optionalString head splitString;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace readJsonOrEmpty getIn mkOptAttrset;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace readJsonOrEmpty getIn mkOptAttrset mkPersistDir;
   inherit (config.networking) hostName;
   base = "${namespace}.services.storage.postgresql";
   cfg = getAttrByNamespace config base;
@@ -92,7 +92,7 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = [
-      "/var/lib/postgresql"
+      (mkPersistDir config "postgres" "/var/lib/postgresql")
     ];
 
     systemd.services.postgresql-setup.postStart = ''
diff --git a/modules/nixos/services/storage/postgresql/pgbouncer.nix b/modules/nixos/services/storage/postgresql/pgbouncer.nix
index 8a56a72..737e012 100644
--- a/modules/nixos/services/storage/postgresql/pgbouncer.nix
+++ b/modules/nixos/services/storage/postgresql/pgbouncer.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf concatStringsSep hasAttr getAttr genAttrs;
-  inherit (lib.${namespace}) getAttrByNamespace readJsonOrEmpty getIn;
+  inherit (lib.${namespace}) getAttrByNamespace readJsonOrEmpty getIn mkPersistDir;
   inherit (config.networking) hostName;
   base = "${namespace}.services.storage.postgresql";
   cfg = getAttrByNamespace config base;
@@ -72,7 +72,7 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = [
-      "/var/lib/pgbouncer"
+      (mkPersistDir config "pgbouncer" "/var/lib/pgbouncer")
     ];
   });
 }
diff --git a/modules/nixos/services/storage/samba/default.nix b/modules/nixos/services/storage/samba/default.nix
index 6f985db..a0e0846 100644
--- a/modules/nixos/services/storage/samba/default.nix
+++ b/modules/nixos/services/storage/samba/default.nix
@@ -5,7 +5,7 @@
   ...
 } @ args: let
   inherit (lib) types mkIf mkEnableOption mkMerge;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkRequiredOpt mkNullableOpt mkListOpt mkOptAttrset;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkRequiredOpt mkNullableOpt mkListOpt mkOptAttrset mkPersistRootDir;
   inherit (config.users) users;
 
   base = "${namespace}.services.storage.samba";
@@ -75,8 +75,8 @@ in {
     };
 
     ${namespace}.services.storage.impermanence.folders = mkMerge [
-      ["/var/lib/samba"]
-      (mkIf (cfg.shares != []) (cfg.shares |> map (s: "/mnt/samba/${s}")))
+      [ (mkPersistRootDir "/var/lib/samba") ]
+      (mkIf (cfg.shares != []) (cfg.shares |> map (s: mkPersistRootDir "/mnt/samba/${s}")))
     ];
   };
 }
diff --git a/modules/nixos/services/storage/syncthing/default.nix b/modules/nixos/services/storage/syncthing/default.nix
index a91d743..17596fd 100644
--- a/modules/nixos/services/storage/syncthing/default.nix
+++ b/modules/nixos/services/storage/syncthing/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) types mkEnableOption mkIf mapAttrs mapAttrs' listToAttrs map;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP mkOpt mkOptAttrset mkListOpt;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace resolveHostIP mkOpt mkOptAttrset mkListOpt mkPersistDir;
   inherit (config.networking) hostName;
   base = "${namespace}.services.storage.syncthing";
   cfg = getAttrByNamespace config base;
@@ -74,7 +74,8 @@ in {
     systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
 
     ${namespace}.services.storage.impermanence.folders = mkIf cfg.enable (
-      ["/mnt/syncthing"] ++ (builtins.attrNames cfg.shares |> map (k: "/mnt/syncthing/${k}"))
+      [ (mkPersistDir config "c4patino" "/mnt/syncthing") ]
+      ++ (builtins.attrNames cfg.shares |> map (k: mkPersistDir config "c4patino" "/mnt/syncthing/${k}"))
     );
   };
 }
diff --git a/modules/nixos/virtualization/docker/default.nix b/modules/nixos/virtualization/docker/default.nix
index b363855..244a97b 100644
--- a/modules/nixos/virtualization/docker/default.nix
+++ b/modules/nixos/virtualization/docker/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption mkOverride;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace mkPersistRootDir;
   base = "${namespace}.virtualization.docker";
   cfg = getAttrByNamespace config base;
   nvdaCfg = getAttrByNamespace config "${namespace}.hardware.nvidia";
@@ -48,6 +48,8 @@ in {
 
     networking.firewall.allowedTCPPorts = [2376];
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/docker"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/var/lib/docker")
+    ];
   };
 }
diff --git a/modules/nixos/virtualization/podman/default.nix b/modules/nixos/virtualization/podman/default.nix
index d329731..501427e 100644
--- a/modules/nixos/virtualization/podman/default.nix
+++ b/modules/nixos/virtualization/podman/default.nix
@@ -6,7 +6,7 @@
   ...
 }: let
   inherit (lib) mkIf mkEnableOption;
-  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace enabled;
+  inherit (lib.${namespace}) getAttrByNamespace mkOptionsWithNamespace enabled mkPersistRootDir;
   base = "${namespace}.virtualization.podman";
   cfg = getAttrByNamespace config base;
   nvdaBase = "${namespace}.hardware.nvidia";
@@ -30,6 +30,8 @@ in {
       podman = enabled;
     };
 
-    ${namespace}.services.storage.impermanence.folders = ["/var/lib/containers"];
+    ${namespace}.services.storage.impermanence.folders = [
+      (mkPersistRootDir "/var/lib/containers")
+    ];
   };
 }