diff --git a/nixos/modules/services/system/nscd.conf b/nixos/modules/services/system/nscd.conf
index bd802bd3c2ee..2b7523a7346d 100644
--- a/nixos/modules/services/system/nscd.conf
+++ b/nixos/modules/services/system/nscd.conf
@@ -6,6 +6,7 @@
 # fallback to trying to handle the request by itself. Which won't work as glibc
 # is not aware of the path in which the nss modules live.  As a workaround, we
 # have `enable-cache yes` with an explicit ttl of 0
+server-user             nscd
 
 enable-cache            passwd          yes
 positive-time-to-live   passwd          0
diff --git a/nixos/modules/services/system/nscd.nix b/nixos/modules/services/system/nscd.nix
index d094e9893ff0..c2d0cd5d0eb0 100644
--- a/nixos/modules/services/system/nscd.nix
+++ b/nixos/modules/services/system/nscd.nix
@@ -53,7 +53,7 @@ in
         ];
 
         serviceConfig =
-          { ExecStart = "@${pkgs.glibc.bin}/sbin/nscd nscd";
+          { ExecStart = "!@${pkgs.glibc.bin}/sbin/nscd nscd";
             Type = "forking";
             DynamicUser = true;
             RuntimeDirectory = "nscd";