diff --git a/services/arr/init.nix b/services/arr/init.nix
index e7c5a84..37ef2a2 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -8,6 +8,7 @@
       dataDir = service_configs.prowlarr.dataDir;
       apiVersion = "v1";
       networkNamespacePath = "/run/netns/wg";
+      healthChecks = true;
       syncedApps = [
         {
           name = "Sonarr";
@@ -57,6 +58,7 @@
       serviceName = "sonarr";
       port = service_configs.ports.sonarr;
       dataDir = service_configs.sonarr.dataDir;
+      healthChecks = true;
       rootFolders = [ service_configs.media.tvDir ];
       downloadClients = [
         {
@@ -78,6 +80,7 @@
       serviceName = "radarr";
       port = service_configs.ports.radarr;
       dataDir = service_configs.radarr.dataDir;
+      healthChecks = true;
       rootFolders = [ service_configs.media.moviesDir ];
       downloadClients = [
         {
diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index a2ad767..2403504 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -11,6 +11,9 @@
       service_configs.prowlarr.dataDir
     ])
     (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
+    (lib.serviceFilePerms "prowlarr" [
+      "Z ${service_configs.prowlarr.dataDir} 0700 prowlarr prowlarr"
+    ])
   ];
 
   services.prowlarr = {
@@ -19,10 +22,6 @@
     settings.server.port = service_configs.ports.prowlarr;
   };
 
-  systemd.services.prowlarr.serviceConfig = {
-    ExecStartPre = "+${pkgs.coreutils}/bin/chown -R prowlarr /var/lib/prowlarr";
-  };
-
   services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr}