diff --git a/modules/programs/shadow.nix b/modules/programs/shadow.nix
index 137064bba85..a3f837c7367 100644
--- a/modules/programs/shadow.nix
+++ b/modules/programs/shadow.nix
@@ -93,7 +93,7 @@ in
         { name = "login"; ownDevices = true; allowNullPassword = true; }
       ];
 
-    security.setuidPrograms = [ "passwd" "chfn" "su" ];
+    security.setuidPrograms = [ "passwd" "chfn" "su" "newgrp" ];
 
   };