diff --git a/services/crowdsec.nix b/services/crowdsec.nix
index a976f39..3e95be9 100644
--- a/services/crowdsec.nix
+++ b/services/crowdsec.nix
@@ -95,7 +95,7 @@ in
             log_level = "info";
             url = "http://log-01.tail755c5.ts.net:3100";
             limit = 1000;
-            query = "{container=\"stirling-pdf\"}";
+            query = "{systemd_unit=\"stirling-pdf\"}";
             labels.type = "stirling-pdf";
           }
         ];