diff --git a/hosts/by-name/desko/default.nix b/hosts/by-name/desko/default.nix
index 94d78c04..1c47b644 100644
--- a/hosts/by-name/desko/default.nix
+++ b/hosts/by-name/desko/default.nix
@@ -54,7 +54,7 @@
     remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
     dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
   };
-  sane.persist.home.plaintext = [
+  sane.user.persist.plaintext = [
     ".steam"
     ".local/share/Steam"
   ];
diff --git a/hosts/by-name/moby/default.nix b/hosts/by-name/moby/default.nix
index 6f9c1c9f..7146d24e 100644
--- a/hosts/by-name/moby/default.nix
+++ b/hosts/by-name/moby/default.nix
@@ -37,7 +37,7 @@
     # addons.sideberry.enable = false;
   };
 
-  sane.persist.home.plaintext = [
+  sane.user.persist.plaintext = [
     ".config/pulse"  # persist pulseaudio volume
   ];
 
diff --git a/hosts/common/home/firefox.nix b/hosts/common/home/firefox.nix
index a26e02be..6f2556cd 100644
--- a/hosts/common/home/firefox.nix
+++ b/hosts/common/home/firefox.nix
@@ -174,11 +174,11 @@ in
 
     sane.packages.extraGuiPkgs = [ package ];
     # flush the cache to disk to avoid it taking up too much tmp
-    sane.persist.home.byPath."${cfg.browser.cacheDir}" = lib.mkIf (cfg.persistCache != null) {
+    sane.user.persist.byPath."${cfg.browser.cacheDir}" = lib.mkIf (cfg.persistCache != null) {
       store = cfg.persistCache;
     };
 
-    sane.persist.home.byPath."${cfg.browser.dotDir}/default" = lib.mkIf (cfg.persistData != null) {
+    sane.user.persist.byPath."${cfg.browser.dotDir}/default" = lib.mkIf (cfg.persistData != null) {
       store = cfg.persistData;
     };
     sane.user.fs."${cfg.browser.dotDir}/default" = sane-lib.fs.wantedDir;
diff --git a/hosts/common/home/keyring.nix b/hosts/common/home/keyring.nix
index 34cb9390..eee9e85e 100644
--- a/hosts/common/home/keyring.nix
+++ b/hosts/common/home/keyring.nix
@@ -1,7 +1,7 @@
 { config, sane-lib, ... }:
 
 {
-  sane.persist.home.private = [ ".local/share/keyrings" ];
+  sane.user.persist.private = [ ".local/share/keyrings" ];
 
   sane.user.fs."private/.local/share/keyrings/default" = {
     generated.script.script = builtins.readFile ../../../scripts/init-keyring;
diff --git a/hosts/common/home/neovim.nix b/hosts/common/home/neovim.nix
index ba7cc386..61f349dc 100644
--- a/hosts/common/home/neovim.nix
+++ b/hosts/common/home/neovim.nix
@@ -72,7 +72,7 @@ let
 in
 {
   # private because there could be sensitive things in the swap
-  sane.persist.home.private = [ ".cache/vim-swap" ];
+  sane.user.persist.private = [ ".cache/vim-swap" ];
 
   programs.neovim = {
     # neovim: https://github.com/neovim/neovim
diff --git a/hosts/common/home/splatmoji.nix b/hosts/common/home/splatmoji.nix
index 7836427d..83bec9d2 100644
--- a/hosts/common/home/splatmoji.nix
+++ b/hosts/common/home/splatmoji.nix
@@ -4,7 +4,7 @@
 { pkgs, sane-lib, ... }:
 
 {
-  sane.persist.home.plaintext = [ ".local/state/splatmoji" ];
+  sane.user.persist.plaintext = [ ".local/state/splatmoji" ];
   sane.user.fs.".config/splatmoji/splatmoji.config" = sane-lib.fs.wantedText ''
     history_file=~/.local/state/splatmoji/history
     history_length=5
diff --git a/hosts/common/home/ssh.nix b/hosts/common/home/ssh.nix
index 986e324b..97adf744 100644
--- a/hosts/common/home/ssh.nix
+++ b/hosts/common/home/ssh.nix
@@ -12,7 +12,7 @@ let
 in
 {
   # ssh key is stored in private storage
-  sane.persist.home.private = [ ".ssh/id_ed25519" ];
+  sane.user.persist.private = [ ".ssh/id_ed25519" ];
   sane.user.fs.".ssh/id_ed25519.pub" = sane-lib.fs.wantedText user-pubkey;
   sane.user.fs.".ssh/known_hosts" = sane-lib.fs.wantedText known-hosts-text;
 
diff --git a/hosts/common/home/zsh/default.nix b/hosts/common/home/zsh/default.nix
index 0a8acbef..5055ddc9 100644
--- a/hosts/common/home/zsh/default.nix
+++ b/hosts/common/home/zsh/default.nix
@@ -26,7 +26,7 @@ let
   '';
 in
 {
-  sane.persist.home.plaintext = [
+  sane.user.persist.plaintext = [
     # we don't need to full zsh dir -- just the history file --
     # but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
     # TODO: should be private?
diff --git a/hosts/common/users.nix b/hosts/common/users.nix
index bc8e4229..72647182 100644
--- a/hosts/common/users.nix
+++ b/hosts/common/users.nix
@@ -77,7 +77,7 @@ in
       mode = config.users.users.colin.homeMode;
     };
 
-    sane.persist.home.plaintext = [
+    sane.user.persist.plaintext = [
       "archive"
       "dev"
       # TODO: records should be private
diff --git a/modules/packages.nix b/modules/packages.nix
index 427c819e..5eb16c9c 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -322,8 +322,8 @@ in
 
   config = {
     environment.systemPackages = mkIf cfg.enableSystemPkgs systemPkgs;
-    sane.persist.home.plaintext = concatLists (map (p: p.dir) cfg.enabledUserPkgs);
-    sane.persist.home.private = concatLists (map (p: p.private) cfg.enabledUserPkgs);
+    sane.user.persist.plaintext = concatLists (map (p: p.dir) cfg.enabledUserPkgs);
+    sane.user.persist.private = concatLists (map (p: p.private) cfg.enabledUserPkgs);
     # XXX: this might not be necessary. try removing this and cacert.unbundled?
     environment.etc."ssl/certs".source = mkIf cfg.enableSystemPkgs "${pkgs.cacert.unbundled}/etc/ssl/certs/*";
   };