diff --git a/modules/services/lorri.nix b/modules/services/lorri.nix
index 85b75682f..f782ff880 100644
--- a/modules/services/lorri.nix
+++ b/modules/services/lorri.nix
@@ -52,6 +52,12 @@ in {
           PrivateTmp = true;
           ProtectSystem = "strict";
           ProtectHome = "read-only";
+          ReadWritePaths = [
+            # /run/user/1000 for the socket
+            "%t"
+            "/nix/var/nix/gcroots/per-user/%u"
+          ];
+          CacheDirectory = [ "lorri" ];
           Restart = "on-failure";
           Environment = let
             path = with pkgs;