diff --git a/docs/dcrwallet.md b/docs/dcrwallet.md
index d50d4a3..dc0e33b 100644
--- a/docs/dcrwallet.md
+++ b/docs/dcrwallet.md
@@ -14,9 +14,9 @@ Render `dcrwallet.conf` with `sops-nix` and point the service at it. For example
   sops.secrets."dcrwallet/rpcpass" = {};
 
   sops.templates."dcrctl.conf" = {
-    path = "/home/operator/.dcrctl/dcrctl.conf";
-    owner = "operator";
-    group = "users";
+    path = "/var/lib/dcrwallet/.dcrctl/dcrctl.conf";
+    owner = config.services.dcrwallet.user;
+    group = config.services.dcrwallet.group;
     mode = "0400";
     content = ''
       [Application Options]
@@ -52,17 +52,13 @@ Render `dcrwallet.conf` with `sops-nix` and point the service at it. For example
       pkgs.dcrctl
       pkgs.dcrd # promptsecret
       ];
-    operator = {
-      enable = true;
-      name = "stakey";
-    };
   };
 }
 ```
 
 ## Initialization
 
-If you run dcrwallet as a service, here's how to intialize a wallet as `root`.
+If you run dcrwallet as a service, initialize its wallet as the `dcrwallet` user.
 
 ```bash
 cd /var/lib/dcrwallet
@@ -79,17 +75,13 @@ Then you need to start dcrwallet manually the first time to sync.
 tmux new "doas -u dcrwallet $DCRWALLET_BIN --configfile=/run/secrets/rendered/dcrwallet.conf --appdata=/var/lib/dcrwallet"
 ```
 
-## Using the operator
-
-```sh
-su - operator
-dcrctl help
-```
-
 ## Enable Voting
 
-Use the operator account.
+The wallet must be unlocked by the `dcrwallet` user. Its home directory is the
+wallet data directory (`/var/lib/dcrwallet` by default), so `dcrctl` reads the
+configuration rendered above from that user's home directory.
 
 ```sh
- promptsecret | dcrwallet walletpassphrase - 0
+su - dcrwallet
+promptsecret | dcrctl --wallet walletpassphrase - 0
 ```
diff --git a/modules/dcrwallet.nix b/modules/dcrwallet.nix
index c2d5757..3547af4 100644
--- a/modules/dcrwallet.nix
+++ b/modules/dcrwallet.nix
@@ -43,19 +43,9 @@ in
       description = "Additional packages to add to the dcrwallet user's environment";
     };
 
-    operator = {
-      enable = mkEnableOption "Install dcrwallet CLI packages for an operator user";
-      name = mkOption {
-        type = types.str;
-        default = "operator";
-        description = "Operator username to receive dcrwallet package(s) in their environment.";
-      };
-    };
-
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
+  config = lib.mkIf cfg.enable {
     users.users.${cfg.user} = {
       group = cfg.group;
       home = cfg.dataDir;
@@ -86,38 +76,5 @@ in
       };
       restartTriggers = [ cfg.configFile ];
     };
-    }
-    (lib.mkIf cfg.operator.enable {
-      users.users.${cfg.operator.name} = {
-        packages = [ cfg.package ] ++ cfg.extraPackages;
-        # Add the operator user to the dcrwallet group and dcrd group
-        extraGroups = [ cfg.group ] ++ lib.optional (dcrdEnabled && config.services.dcrd.group != cfg.group) config.services.dcrd.group;
-      };
-
-      # Ensure operator (a member of cfg.group) can read rpc.cert which dcrwallet
-      # writes with mode 0600 by default. We watch for the file and set g+r.
-      systemd.services.dcrwallet-cert-perms = {
-        description = "Ensure group-read on dcrwallet rpc.cert";
-        after = [ "dcrwallet.service" ];
-        serviceConfig = {
-          Type = "oneshot";
-        };
-        script = ''
-          if [ -e ${cfg.dataDir}/rpc.cert ]; then
-            ${pkgs.coreutils}/bin/chmod g+r ${cfg.dataDir}/rpc.cert
-          fi
-        '';
-      };
-
-      systemd.paths.dcrwallet-cert-perms = {
-        description = "Watch dcrwallet rpc.cert to fix permissions";
-        pathConfig = {
-#         PathModified = "${cfg.dataDir}/rpc.cert";
-          PathChanged = "${cfg.dataDir}/rpc.cert";
-        };
-        wantedBy = [ "multi-user.target" ];
-      };
-    })
-  ]);
+  };
 }
-