diff --git a/hosts/sire/guests/paperless.nix b/hosts/sire/guests/paperless.nix
index 1959ede..83c4988 100644
--- a/hosts/sire/guests/paperless.nix
+++ b/hosts/sire/guests/paperless.nix
@@ -67,6 +67,13 @@ in {
       PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
       PAPERLESS_TRUSTED_PROXIES = sentinelCfg.meta.wireguard.proxy-sentinel.ipv4;
 
+      # virtiofsd doesn't send inotify events (not sure if generally, or because we
+      # mount the same host share on another vm (samba) and modify it there).
+      PAPERLESS_CONSUMER_POLLING = 1; # seconds
+      # Wait three seconds between file-modified checks. After 5 consecutive checks
+      # where the file wasn't modified it will be consumed.
+      PAPERLESS_CONSUMER_POLLING_DELAY = 3;
+
       PAPERLESS_CONSUMER_ENABLE_BARCODES = true;
       PAPERLESS_CONSUMER_ENABLE_ASN_BARCODE = true;
       PAPERLESS_CONSUMER_BARCODE_SCANNER = "ZXING";
diff --git a/hosts/sire/guests/samba.nix b/hosts/sire/guests/samba.nix
index 1451f6a..e790548 100644
--- a/hosts/sire/guests/samba.nix
+++ b/hosts/sire/guests/samba.nix
@@ -363,6 +363,7 @@ in {
       sshAgeSecret = "restic-ssh-privkey";
     };
 
+    # We need to backup stuff from other users, so run as root.
     user = "root";
     timerConfig = {
       OnCalendar = "06:15";
diff --git a/hosts/ward/guests/vaultwarden.nix b/hosts/ward/guests/vaultwarden.nix
index ffa6249..5c04682 100644
--- a/hosts/ward/guests/vaultwarden.nix
+++ b/hosts/ward/guests/vaultwarden.nix
@@ -101,7 +101,7 @@ in {
       sshAgeSecret = "restic-ssh-privkey";
     };
 
-    user = "root";
+    user = "vaultwarden";
     timerConfig = {
       OnCalendar = "06:15";
       RandomizedDelaySec = "3h";