diff --git a/modules/common/podman.nix b/modules/common/podman.nix
index 40f7269..0f44f92 100644
--- a/modules/common/podman.nix
+++ b/modules/common/podman.nix
@@ -2,7 +2,7 @@
 {
   virtualisation.podman.enable = true;
 
-  # Sync everything in ./containers/ to the containers user's quadlet directory
+  # User containers (rootless, as the containers user)
   system.activationScripts.containers-quadlets = {
     text = ''
       mkdir -p /var/lib/containers/.config/containers/systemd
@@ -11,4 +11,13 @@
     '';
     deps = [ "users" ];
   };
+
+  # System containers (rootful, can bind low ports like 80/443)
+  system.activationScripts.system-containers-quadlets = {
+    text = ''
+      mkdir -p /etc/containers/systemd
+      cp -r ${./system-containers}/* /etc/containers/systemd/
+    '';
+    deps = [ "users" ];
+  };
 }