diff --git a/hosts/ward/microvms/adguardhome.nix b/hosts/ward/microvms/adguardhome.nix
index d2cd584..0caaf7b 100644
--- a/hosts/ward/microvms/adguardhome.nix
+++ b/hosts/ward/microvms/adguardhome.nix
@@ -42,6 +42,8 @@ in {
 
   services.adguardhome = {
     enable = true;
+    # TODO allow mutable settings, replace 123.123.123.123 with
+    # simpler sed dns.host_addr logic.
     mutableSettings = false;
     settings = {
       bind_host = config.meta.wireguard.proxy-sentinel.ipv4;
diff --git a/modules/config/impermanence.nix b/modules/config/impermanence.nix
index 753cea1..71ee8d8 100644
--- a/modules/config/impermanence.nix
+++ b/modules/config/impermanence.nix
@@ -157,6 +157,14 @@
           group = "telegraf";
           mode = "0700";
         }
+      ]
+      ++ lib.optionals config.services.adguardhome.enable [
+        {
+          directory = "/var/lib/adguardhome";
+          user = "adguardhome";
+          group = "adguardhome";
+          mode = "0700";
+        }
       ];
   };
 }