diff --git a/apps/nas-samba/source/app/server.js b/apps/nas-samba/source/app/server.js
index 88e6fd4..2c568ff 100644
--- a/apps/nas-samba/source/app/server.js
+++ b/apps/nas-samba/source/app/server.js
@@ -175,7 +175,8 @@ function createSystemUser(username, password) {
   execSync(`id -u "${username}" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin "${username}"`);
   const homeDir = path.join(HOME_BASE, username);
   fs.mkdirSync(homeDir, { recursive: true });
-  execSync(`chown "${username}":nogroup "${homeDir}"`);
+  execSync(`chown -R "${username}":"${username}" "${homeDir}"`);
+  execSync(`chmod 0700 "${homeDir}"`);
   const escaped = password.replace(/'/g, "'\\''");
   execSync(`printf '%s\\n%s\\n' '${escaped}' '${escaped}' | smbpasswd -a -s "${username}"`);
 }
@@ -1682,7 +1683,8 @@ function main() {
       fs.mkdirSync(homeDir, { recursive: true });
       try {
         execSync(`id -u "${u.username}" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin "${u.username}"`);
-        execSync(`chown "${u.username}":nogroup "${homeDir}"`);
+        execSync(`chown -R "${u.username}":"${u.username}" "${homeDir}"`);
+        execSync(`chmod 0700 "${homeDir}"`);
         // Set Samba password only if user not already in TDB (first run or migration)
         try {
           execSync(`pdbedit -u "${u.username}" >/dev/null 2>&1`);