diff --git a/plinth/modules/radicale/__init__.py b/plinth/modules/radicale/__init__.py
index 3ba77f71c..6895f4386 100644
--- a/plinth/modules/radicale/__init__.py
+++ b/plinth/modules/radicale/__init__.py
@@ -43,7 +43,7 @@ class RadicaleApp(app_module.App):
 
     app_id = 'radicale'
 
-    _version = 3
+    _version = 4
 
     def __init__(self) -> None:
         """Create components for the app."""
@@ -102,6 +102,7 @@ class RadicaleApp(app_module.App):
     def setup(self, old_version):
         """Install and configure the app."""
         super().setup(old_version)
+        privileged.setup()
         if not old_version:
             self.enable()
 
@@ -117,6 +118,7 @@ class RadicaleApp(app_module.App):
 
         rights = get_rights_value()
         install(['radicale'], force_configuration='new')
+        privileged.setup()
         privileged.configure(rights)
 
         return True
diff --git a/plinth/modules/radicale/privileged.py b/plinth/modules/radicale/privileged.py
index 7c950dcf0..8508fd56d 100644
--- a/plinth/modules/radicale/privileged.py
+++ b/plinth/modules/radicale/privileged.py
@@ -12,6 +12,20 @@ CONFIG_FILE = '/etc/radicale/config'
 LOG_PATH = '/var/log/radicale'
 
 
+@privileged
+def setup():
+    """Configure authentication to Apache remote user.
+
+    For radicale < 3.5 (bookworm), this was set by configuration shipped with
+    Debian. For radicale >= 3.5 (trixie), this needs to be explicitly. For
+    simplicity, set is unconditionally.
+    """
+    aug = load_augeas()
+    aug.set('auth/type', 'remote_user')
+    aug.save()
+    action_utils.service_try_restart('uwsgi')
+
+
 @privileged
 def configure(rights_type: str):
     """Set the radicale rights type to a particular value."""
@@ -20,7 +34,7 @@ def configure(rights_type: str):
         rights_type = 'from_file'
 
     aug = load_augeas()
-    aug.set('/files' + CONFIG_FILE + '/rights/type', rights_type)
+    aug.set('rights/type', rights_type)
     aug.save()
 
     action_utils.service_try_restart('uwsgi')
@@ -38,10 +52,8 @@ def load_augeas():
     """Initialize Augeas."""
     aug = augeas.Augeas(flags=augeas.Augeas.NO_LOAD +
                         augeas.Augeas.NO_MODL_AUTOLOAD)
-
     # INI file lens
-    aug.set('/augeas/load/Puppet/lens', 'Puppet.lns')
-    aug.set('/augeas/load/Puppet/incl[last() + 1]', CONFIG_FILE)
-
+    aug.transform('Puppet', CONFIG_FILE)
+    aug.set('/augeas/context', '/files' + CONFIG_FILE)
     aug.load()
     return aug