diff --git a/sshca/config.toml b/sshca/config.toml
index ee09314..3171fdb 100644
--- a/sshca/config.toml
+++ b/sshca/config.toml
@@ -12,6 +12,12 @@ private_key_passphrase_file = "/run/sshca/secrets/host/passphrase/host-ca-key.pa
 private_key_file = "/run/sshca/secrets/user/key/user-ca-key"
 private_key_passphrase_file = "/run/sshca/secrets/user/passphrase/user-ca-key.passphrase"
 
+[ca.user.group_principals]
+"Server Admins" = [
+    "core",
+    "root",
+]
+
 [[libvirt]]
 uri = "qemu+ssh://sshca@vmhost0.pyrocufflink.blue/system?keyfile=/run/sshca/libvirt/sshkey"