diff --git a/modules/apps/arr/default.nix b/modules/apps/arr/default.nix
index 1b1ce53..befd61b 100644
--- a/modules/apps/arr/default.nix
+++ b/modules/apps/arr/default.nix
@@ -95,22 +95,17 @@ in {
     };
 
     # Create a user for each app.
-    users.users = let
+    homelab.appUsers = let
       mkUser = uid: {
-        uid = lib.mkForce uid;
-        isSystemUser = true;
+        inherit uid;
         group = config.users.groups.media.name;
-        home = "/var/empty";
-        shell = null;
       };
     in {
       bazarr = lib.mkIf cfg.bazarr.enable (mkUser 3003);
       prowlarr = lib.mkIf cfg.prowlarr.enable (mkUser 3004);
-      qbittorrent = lib.mkIf cfg.qbittorrent.enable (mkUser 3005) // {
-        extraGroups = [
-          config.users.groups.apps.name
-        ];
-      };
+      qbittorrent = lib.mkIf cfg.qbittorrent.enable ((mkUser 3005) // {
+        extraGroups = [ config.users.groups.apps.name ];
+      });
       radarr = lib.mkIf cfg.radarr.enable (mkUser 3006);
       sonarr = lib.mkIf cfg.sonarr.enable (mkUser 3007);
     };
diff --git a/modules/apps/calibre/default.nix b/modules/apps/calibre/default.nix
index ea722bc..f342679 100644
--- a/modules/apps/calibre/default.nix
+++ b/modules/apps/calibre/default.nix
@@ -34,12 +34,9 @@ in {
         virtualisation.containers.enable = true;
       };
 
-      users.users.calibre = {
-        uid = lib.mkForce 3010;
-        isSystemUser = true;
+      homelab.appUsers.calibre = {
+        uid = 3010;
         group = config.users.groups.media.name;
-        home = "/var/empty";
-        shell = null;
       };
 
       homelab.nfsMounts."${books}" = {
diff --git a/modules/apps/gitea/default.nix b/modules/apps/gitea/default.nix
index 9073c38..eeec8b6 100644
--- a/modules/apps/gitea/default.nix
+++ b/modules/apps/gitea/default.nix
@@ -30,12 +30,8 @@ in {
       virtualisation.containers.enable = true;
     };
 
-    users.users.gitea = {
-      uid = lib.mkForce UID;
-      isSystemUser = true;
-      group = config.users.groups.apps.name;
-      home = "/var/empty";
-      shell = null;
+    homelab.appUsers.gitea = {
+      uid = UID;
     };
 
     # Use filesystem mounts because rootless containers otherwise don't have access to the mount path (nested in docker directories).
diff --git a/modules/apps/homepage/default.nix b/modules/apps/homepage/default.nix
index cc1b43b..5901ee7 100644
--- a/modules/apps/homepage/default.nix
+++ b/modules/apps/homepage/default.nix
@@ -26,12 +26,8 @@ in {
       virtualisation.containers.enable = true;
     };
 
-    users.users.homepage = {
-      uid = lib.mkForce 3018;
-      isSystemUser = true;
-      group = config.users.groups.apps.name;
-      home = "/var/empty";
-      shell = null;
+    homelab.appUsers.homepage = {
+      uid = 3018;
     };
 
     homelab.nfsMounts."${homepage-config}" = {
diff --git a/modules/apps/jellyfin/default.nix b/modules/apps/jellyfin/default.nix
index 560f527..56fba09 100644
--- a/modules/apps/jellyfin/default.nix
+++ b/modules/apps/jellyfin/default.nix
@@ -36,15 +36,9 @@ in {
       "/srv/photo" = mkMount "192.168.0.11:/mnt/BIG/MEDIA/PHOTO/ARCHIVE";
     };
 
-    users.users.jellyfin = {
-      uid = lib.mkForce UID;
-      isSystemUser = true;
-      group = config.users.groups.apps.name;
-      extraGroups = [
-        config.users.groups.media.name
-      ];
-      home = "/var/empty";
-      shell = null;
+    homelab.appUsers.jellyfin = {
+      uid = UID;
+      extraGroups = [ config.users.groups.media.name ];
     };
 
     # Make sure the Docker network exists.
diff --git a/modules/common/default.nix b/modules/common/default.nix
index 0a6ac0e..98b415e 100644
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@@ -3,6 +3,7 @@
     ./docker.nix
     ./monitoring.nix
     ./nfs.nix
+    ./users.nix
   ];
 
   config = {
diff --git a/modules/common/users.nix b/modules/common/users.nix
new file mode 100644
index 0000000..59aaea0
--- /dev/null
+++ b/modules/common/users.nix
@@ -0,0 +1,37 @@
+{ config, lib, ... }:
+
+{
+  options.homelab.appUsers = lib.mkOption {
+    type = lib.types.attrsOf (lib.types.submodule {
+      options = {
+        uid = lib.mkOption {
+          type = lib.types.int;
+          description = "The user ID for the app user";
+        };
+        group = lib.mkOption {
+          type = lib.types.str;
+          default = config.users.groups.apps.name;
+          description = "The primary group for the app user";
+        };
+        extraGroups = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [];
+          description = "Extra groups for the app user";
+        };
+      };
+    });
+    default = {};
+    description = "App users to automatically create with standard homelab options";
+  };
+
+  config = {
+    users.users = lib.mapAttrs (name: cfg: {
+      uid = lib.mkForce cfg.uid;
+      isSystemUser = true;
+      group = cfg.group;
+      extraGroups = cfg.extraGroups;
+      home = "/var/empty";
+      shell = null;
+    }) config.homelab.appUsers;
+  };
+}