diff --git a/src/constants.js b/src/constants.js
index 25db330bf..60e1c5e8c 100644
--- a/src/constants.js
+++ b/src/constants.js
@@ -32,8 +32,6 @@ exports = module.exports = {
 
     NGINX_DEFAULT_CONFIG_FILE_NAME: 'default.conf',
 
-    GHOST_USER_FILE: '/home/yellowtent/platformdata/cloudron_ghost.json',
-
     DEFAULT_TOKEN_EXPIRATION: 7 * 24 * 60 * 60 * 1000, // 1 week
 
     DEFAULT_MEMORY_LIMIT: (256 * 1024 * 1024), // see also client.js
diff --git a/src/paths.js b/src/paths.js
index b2ac03506..f94a8e8e2 100644
--- a/src/paths.js
+++ b/src/paths.js
@@ -51,6 +51,8 @@ exports = module.exports = {
     TASKS_LOG_DIR: path.join(baseDir(), 'platformdata/logs/tasks'),
     CRASH_LOG_DIR: path.join(baseDir(), 'platformdata/logs/crash'),
 
+    GHOST_USER_FILE: path.join(baseDir(), 'platformdata/cloudron_ghost.json'),
+
     // this pattern is for the cloudron logs API route to work
     BACKUP_LOG_FILE: path.join(baseDir(), 'platformdata/logs/backup/app.log'),
     UPDATER_LOG_FILE: path.join(baseDir(), 'platformdata/logs/updater/app.log')
diff --git a/src/test/users-test.js b/src/test/users-test.js
index b7055dc02..c0f516b15 100644
--- a/src/test/users-test.js
+++ b/src/test/users-test.js
@@ -18,6 +18,7 @@ var async = require('async'),
     mailboxdb = require('../mailboxdb.js'),
     maildb = require('../maildb.js'),
     mailer = require('../mailer.js'),
+    paths = require('../paths.js'),
     settings = require('../settings.js'),
     userdb = require('../userdb.js'),
     users = require('../users.js'),
@@ -283,10 +284,10 @@ describe('User', function () {
         it('fails for ghost with wrong password', function (done) {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verify(userObject.id, 'foobar', users.AP_WEBADMIN, function (error) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.be.a(BoxError);
                 expect(error.reason).to.equal(BoxError.INVALID_CREDENTIALS);
@@ -297,10 +298,10 @@ describe('User', function () {
         it('succeeds for ghost', function (done) {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verify(userObject.id, 'testpassword', users.AP_WEBADMIN, function (error, result) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.equal(null);
                 expect(result.id).to.equal(userObject.id);
@@ -315,10 +316,10 @@ describe('User', function () {
         it('succeeds for normal user password when ghost file exists', function (done) {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verify(userObject.id, PASSWORD, users.AP_WEBADMIN, function (error, result) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.not.be.ok();
                 expect(result).to.be.ok();
@@ -385,10 +386,10 @@ describe('User', function () {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
 
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verifyWithUsername(USERNAME, 'foobar', users.AP_WEBADMIN, function (error) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.be.a(BoxError);
                 expect(error.reason).to.equal(BoxError.INVALID_CREDENTIALS);
@@ -400,10 +401,10 @@ describe('User', function () {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
 
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verifyWithUsername(USERNAME, 'testpassword', users.AP_WEBADMIN, function (error, result) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.equal(null);
                 expect(result.id).to.equal(userObject.id);
@@ -472,10 +473,10 @@ describe('User', function () {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
 
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verifyWithEmail(EMAIL, 'foobar', users.AP_WEBADMIN, function (error) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.be.a(BoxError);
                 expect(error.reason).to.equal(BoxError.INVALID_CREDENTIALS);
@@ -487,10 +488,10 @@ describe('User', function () {
             var ghost = { };
             ghost[userObject.username] = 'testpassword';
 
-            fs.writeFileSync(constants.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
+            fs.writeFileSync(paths.GHOST_USER_FILE, JSON.stringify(ghost), 'utf8');
 
             users.verifyWithEmail(EMAIL, 'testpassword', users.AP_WEBADMIN, function (error, result) {
-                fs.unlinkSync(constants.GHOST_USER_FILE);
+                fs.unlinkSync(paths.GHOST_USER_FILE);
 
                 expect(error).to.equal(null);
                 expect(result.id).to.equal(userObject.id);
diff --git a/src/users.js b/src/users.js
index 472e74dbd..9224ce6cc 100644
--- a/src/users.js
+++ b/src/users.js
@@ -58,6 +58,7 @@ let assert = require('assert'),
     groups = require('./groups.js'),
     hat = require('./hat.js'),
     mailer = require('./mailer.js'),
+    paths = require('./paths.js'),
     qrcode = require('qrcode'),
     safe = require('safetydance'),
     settings = require('./settings.js'),
@@ -209,7 +210,7 @@ function verifyGhost(username, password) {
     assert.strictEqual(typeof username, 'string');
     assert.strictEqual(typeof password, 'string');
 
-    var ghostData = safe.JSON.parse(safe.fs.readFileSync(constants.GHOST_USER_FILE, 'utf8'));
+    var ghostData = safe.JSON.parse(safe.fs.readFileSync(paths.GHOST_USER_FILE, 'utf8'));
     if (!ghostData) return false;
 
     if (username in ghostData && ghostData[username] === password) {