diff --git a/core/installer/tasks/infra.go b/core/installer/tasks/infra.go
index c7e6f9e..6fbd55d 100644
--- a/core/installer/tasks/infra.go
+++ b/core/installer/tasks/infra.go
@@ -4,12 +4,15 @@
 	"fmt"
 	"net"
 	"net/netip"
+	"strings"
 
 	"github.com/miekg/dns"
 
 	"github.com/giolekva/pcloud/core/installer"
 )
 
+var initGroups = []string{"admin"}
+
 func SetupInfra(env Env, startIP net.IP, st *state) []Task {
 	t := newLeafTask("Create client", func() error {
 		repo, err := st.ssClient.GetRepo("config")
@@ -29,6 +32,7 @@
 	})
 	return []Task{
 		CommitEnvironmentConfiguration(env, st),
+		ConfigureFirstAccount(env, st),
 		&t,
 		newConcurrentParentTask(
 			"Core services",
@@ -103,6 +107,27 @@
 	return &t
 }
 
+type firstAccount struct {
+	Created bool     `json:"created"`
+	Groups  []string `json:"groups"`
+}
+
+func ConfigureFirstAccount(env Env, st *state) Task {
+	t := newLeafTask("Configure first account settings", func() error {
+		repo, err := st.ssClient.GetRepo("config")
+		if err != nil {
+			return err
+		}
+		r := installer.NewRepoIO(repo, st.ssClient.Signer)
+		fa := firstAccount{false, initGroups}
+		if err := r.WriteYaml("first-account.yaml", fa); err != nil {
+			return err
+		}
+		return r.CommitAndPush("first account membership configuration")
+	})
+	return &t
+}
+
 func SetupNetwork(env Env, startIP net.IP, st *state) Task {
 	t := newLeafTask("Setup network", func() error {
 		startAddr, err := netip.ParseAddr(startIP.String())
@@ -236,7 +261,9 @@
 		if err != nil {
 			return err
 		}
-		if err := st.appManager.Install(app, st.nsGen, st.emptySuffixGen, map[string]any{}); err != nil {
+		if err := st.appManager.Install(app, st.nsGen, st.emptySuffixGen, map[string]any{
+			"authGroups": strings.Join(initGroups, ","),
+		}); err != nil {
 			return err
 		}
 		return nil