diff --git a/modules/nixos/services/audiobookshelf/default.nix b/modules/nixos/services/audiobookshelf/default.nix
index 3f164234..da9ec555 100644
--- a/modules/nixos/services/audiobookshelf/default.nix
+++ b/modules/nixos/services/audiobookshelf/default.nix
@@ -47,7 +47,7 @@ in
     environment.etc = {
       "fail2ban/filter.d/audiobookshelf.conf".text = ''
         [Definition]
-        failregex = ERROR: \[Auth\] Failed login attempt for username ".*" from ip <ADDR>
+        failregex = ^.*ERROR: \[Auth\] Failed login attempt for username ".*" from ip <ADDR>
         journalmatch = _SYSTEMD_UNIT=audiobookshelf.service
       '';
     };
diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 6d591096..664d5ba8 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -83,7 +83,7 @@ in
     environment.etc = {
       "fail2ban/filter.d/mealie.conf".text = ''
         [Definition]
-        failregex = ^ERROR.*Incorrect username or password from <HOST>
+        failregex = ^.*ERROR.*Incorrect username or password from <HOST>
         journalmatch = _SYSTEMD_UNIT=mealie.service
       '';
     };
diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index e0795e8e..b623b442 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -101,9 +101,9 @@ in
         [Definition]
         _groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
         datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
-        failregex = \{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
-                    \{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
-                    \{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
+        failregex = ^[^{]*\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+                    ^[^{]*\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+                    ^[^{]*\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
         journalmatch = _SYSTEMD_UNIT=phpfpm-nextcloud.service
       '';
     };