diff --git a/services/collabora-office.nix b/services/collabora-office.nix
index 6b6bba8..4593411 100644
--- a/services/collabora-office.nix
+++ b/services/collabora-office.nix
@@ -18,14 +18,16 @@ in {
       extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
     };
     extraOptions = [
-      "--runtime-flag=directfs=false"
-      "--runtime-flag=network=host"
+      "--runtime=crun"
       "--uidmap=0:65534:1"
       "--gidmap=0:65534:1"
       "--uidmap=100:${toString uid}:1"
       "--gidmap=101:${toString gid}:1"
       "--network=host"
       "--cap-add=MKNOD"
+      "--cap-add=CHOWN"
+      "--cap-add=FOWNER"
+      "--cap-add=SYS_CHROOT"
       "--label=io.containers.autoupdate=registry"
     ];
   };
diff --git a/services/immich.nix b/services/immich.nix
index 9435959..0d4eda3 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -37,7 +37,6 @@ let
       config.age.secrets.immich-typesense-env.path
     ];
     extraOptions = [
-      "--runtime-flag=directfs=false"
       "--runtime-flag=network=host"
       "--uidmap=0:65534:1"
       "--gidmap=0:65534:1"