diff --git a/services/forgejo/index.ts b/services/forgejo/index.ts
index 9eda351..970d606 100644
--- a/services/forgejo/index.ts
+++ b/services/forgejo/index.ts
@@ -1,10 +1,9 @@
 import { buildForgejo } from "./build.js";
 import { Alpine } from "../../alpine.js";
 import { Runit } from "../../runit/index.js";
-import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { loadForgejoSecretsFile } from "./secrets.js";
-import { sudoChown, sudoCopy, sudoWriteFile } from "../../helpers/sudo.js";
+import { sudoCopy } from "../../helpers/sudo.js";
 
 export async function setupForgejo(alpine: Alpine, runit: Runit) {
   const bin = await buildForgejo();
@@ -20,9 +19,8 @@ export async function setupForgejo(alpine: Alpine, runit: Runit) {
   });
 
   const secrets = await loadForgejoSecretsFile();
-  const configPath = join(alpine.dir, "/etc/forgejo.conf");
-  await sudoWriteFile(
-    configPath,
+  await alpine.writeFile(
+    "/etc/forgejo.conf",
     `
 ; see https://docs.gitea.io/en-us/config-cheat-sheet/ for additional documentation.
 
@@ -145,9 +143,8 @@ ALLOWED_HOST_LIST=external,loopback
 REPO_INDEXER_ENABLED=true
 REPO_INDEXER_EXCLUDE=**.mp4,**.jpg
     `,
-    { mode: 0o600 }
+    entry
   );
-  await sudoChown(configPath, `${entry.uid}:${entry.gid}`);
   await runit.addService(
     "forgejo",
     `#!/bin/sh