diff --git a/modules/k3s/default.nix b/modules/k3s/default.nix
index a15538a..e67cabd 100644
--- a/modules/k3s/default.nix
+++ b/modules/k3s/default.nix
@@ -23,6 +23,10 @@ in
     boot.kernelModules = [ "fuse" ];
     programs.fuse.userAllowOther = true;
 
+    services.udev.extraRules = ''
+      KERNEL=="fuse", MODE="0666", OWNER="root", GROUP="root"
+    '';
+
     networking.firewall.allowedTCPPorts = [
       6443 # k3s, api server
       2379 # k3s, etcd clients
@@ -69,7 +73,6 @@ in
       images = import ./images args;
       disable = [];
     };
-    # systemd.services.k3s.serviceConfig.DeviceAllow = mkForce [ "/dev/fuse rwm" ];
     systemd.services.k3s = {
       restartTriggers = [
         (builtins.toJSON config.services.k3s.manifests)
diff --git a/modules/k3s/deployments/storage-combo.nix b/modules/k3s/deployments/storage-combo.nix
index d6f89a0..414237c 100644
--- a/modules/k3s/deployments/storage-combo.nix
+++ b/modules/k3s/deployments/storage-combo.nix
@@ -36,7 +36,10 @@
                     mountPath = "/dev/fuse";
                   }
                 ];
-                securityContext.capabilities.add = ["SYS_ADMIN"];
+                securityContext = {
+                  capabilities.add = ["SYS_ADMIN"];
+                  # privileged = true;
+                };
               }
             ];
             volumes = [