diff --git a/Emby.Server.Implementations/HttpServer/Security/AuthService.cs b/Emby.Server.Implementations/HttpServer/Security/AuthService.cs
index ad7b76d4fd..eace86d51c 100644
--- a/Emby.Server.Implementations/HttpServer/Security/AuthService.cs
+++ b/Emby.Server.Implementations/HttpServer/Security/AuthService.cs
@@ -4,6 +4,7 @@ using System;
 using System.Linq;
 using System.Security.Authentication;
 using Emby.Server.Implementations.SocketSharp;
+using Jellyfin.Data.Entities;
 using Jellyfin.Data.Enums;
 using MediaBrowser.Common.Net;
 using MediaBrowser.Controller.Configuration;
@@ -44,14 +45,14 @@ namespace Emby.Server.Implementations.HttpServer.Security
             ValidateUser(request, authAttribtues);
         }
 
-        public Jellyfin.Data.Entities.User Authenticate(HttpRequest request, IAuthenticationAttributes authAttributes)
+        public User Authenticate(HttpRequest request, IAuthenticationAttributes authAttributes)
         {
             var req = new WebSocketSharpRequest(request, null, request.Path, _logger);
             var user = ValidateUser(req, authAttributes);
             return user;
         }
 
-        private Jellyfin.Data.Entities.User ValidateUser(IRequest request, IAuthenticationAttributes authAttribtues)
+        private User ValidateUser(IRequest request, IAuthenticationAttributes authAttribtues)
         {
             // This code is executed before the service
             var auth = _authorizationContext.GetAuthorizationInfo(request);
@@ -104,9 +105,9 @@ namespace Emby.Server.Implementations.HttpServer.Security
         }
 
         private void ValidateUserAccess(
-            Jellyfin.Data.Entities.User user,
+            User user,
             IRequest request,
-            IAuthenticationAttributes authAttribtues,
+            IAuthenticationAttributes authAttributes,
             AuthorizationInfo auth)
         {
             if (user.HasPermission(PermissionKind.IsDisabled))
@@ -120,7 +121,7 @@ namespace Emby.Server.Implementations.HttpServer.Security
             }
 
             if (!user.HasPermission(PermissionKind.IsAdministrator)
-                && !authAttribtues.EscapeParentalControl
+                && !authAttributes.EscapeParentalControl
                 && !user.IsParentalScheduleAllowed())
             {
                 request.Response.Headers.Add("X-Application-Error-Code", "ParentalControl");
@@ -178,7 +179,7 @@ namespace Emby.Server.Implementations.HttpServer.Security
             return false;
         }
 
-        private static void ValidateRoles(string[] roles, Jellyfin.Data.Entities.User user)
+        private static void ValidateRoles(string[] roles, User user)
         {
             if (roles.Contains("admin", StringComparer.OrdinalIgnoreCase))
             {
diff --git a/Jellyfin.Data/Entities/Group.cs b/Jellyfin.Data/Entities/Group.cs
index 017fb22342..ecef4102ce 100644
--- a/Jellyfin.Data/Entities/Group.cs
+++ b/Jellyfin.Data/Entities/Group.cs
@@ -89,14 +89,13 @@ namespace Jellyfin.Data.Entities
          *************************************************************************/
 
         [ForeignKey("Permission_GroupPermissions_Id")]
-        public ICollection<Permission> Permissions { get; protected set; }
+        public virtual ICollection<Permission> Permissions { get; protected set; }
 
         [ForeignKey("ProviderMapping_ProviderMappings_Id")]
-        public ICollection<ProviderMapping> ProviderMappings { get; protected set; }
+        public virtual ICollection<ProviderMapping> ProviderMappings { get; protected set; }
 
         [ForeignKey("Preference_Preferences_Id")]
-        public ICollection<Preference> Preferences { get; protected set; }
-
+        public virtual ICollection<Preference> Preferences { get; protected set; }
     }
 }
 
diff --git a/Jellyfin.Data/Entities/User.cs b/Jellyfin.Data/Entities/User.cs
index 334e6306d3..bd1cde31ce 100644
--- a/Jellyfin.Data/Entities/User.cs
+++ b/Jellyfin.Data/Entities/User.cs
@@ -222,7 +222,7 @@ namespace Jellyfin.Data.Entities
         [Required]
         public long InternalId { get; set; }
 
-        public ImageInfo ProfileImage { get; set; }
+        public virtual ImageInfo ProfileImage { get; set; }
 
         /// <summary>
         /// Gets or sets the row version.
@@ -241,24 +241,26 @@ namespace Jellyfin.Data.Entities
          * Navigation properties
          *************************************************************************/
         [ForeignKey("Group_Groups_Guid")]
-        public ICollection<Group> Groups { get; protected set; }
+        public virtual ICollection<Group> Groups { get; protected set; }
 
         [ForeignKey("Permission_Permissions_Guid")]
-        public ICollection<Permission> Permissions { get; protected set; }
+        public virtual ICollection<Permission> Permissions { get; protected set; }
 
         [ForeignKey("ProviderMapping_ProviderMappings_Id")]
-        public ICollection<ProviderMapping> ProviderMappings { get; protected set; }
+        public virtual ICollection<ProviderMapping> ProviderMappings { get; protected set; }
 
         [ForeignKey("Preference_Preferences_Guid")]
-        public ICollection<Preference> Preferences { get; protected set; }
+        public virtual ICollection<Preference> Preferences { get; protected set; }
 
-        public ICollection<AccessSchedule> AccessSchedules { get; protected set; }
+        public virtual ICollection<AccessSchedule> AccessSchedules { get; protected set; }
 
         partial void Init();
 
         public bool HasPermission(PermissionKind permission)
         {
-            return Permissions.First(p => p.Kind == permission).Value;
+            var list = Permissions.Where(p => p.Kind == permission);
+
+            return list.First().Value;
         }
 
         public void SetPermission(PermissionKind kind, bool value)
diff --git a/Jellyfin.Data/Jellyfin.Data.csproj b/Jellyfin.Data/Jellyfin.Data.csproj
index b2a3f7eb34..97495297e0 100644
--- a/Jellyfin.Data/Jellyfin.Data.csproj
+++ b/Jellyfin.Data/Jellyfin.Data.csproj
@@ -21,6 +21,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="3.1.3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="3.1.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="3.1.3" />
   </ItemGroup>
 
 </Project>
diff --git a/Jellyfin.Server/CoreAppHost.cs b/Jellyfin.Server/CoreAppHost.cs
index b4c5fd4ea0..81ae384677 100644
--- a/Jellyfin.Server/CoreAppHost.cs
+++ b/Jellyfin.Server/CoreAppHost.cs
@@ -65,8 +65,10 @@ namespace Jellyfin.Server
 
             // TODO: Set up scoping and use AddDbContextPool
             serviceCollection.AddDbContext<JellyfinDb>(
-                    options => options.UseSqlite($"Filename={Path.Combine(ApplicationPaths.DataPath, "jellyfin.db")}"),
-                    ServiceLifetime.Transient);
+                options => options
+                    .UseSqlite($"Filename={Path.Combine(ApplicationPaths.DataPath, "jellyfin.db")}")
+                    .UseLazyLoadingProxies(),
+                ServiceLifetime.Transient);
 
             serviceCollection.AddSingleton<JellyfinDbProvider>();
 
diff --git a/MediaBrowser.Api/UserService.cs b/MediaBrowser.Api/UserService.cs
index 8d4450c1ae..e19ec47f8d 100644
--- a/MediaBrowser.Api/UserService.cs
+++ b/MediaBrowser.Api/UserService.cs
@@ -276,7 +276,8 @@ namespace MediaBrowser.Api
         {
             var result = _userManager
                 .Users
-                .Where(item => !item.HasPermission(PermissionKind.IsDisabled));
+                .Where(user => !user.HasPermission(PermissionKind.IsDisabled))
+                .AsQueryable();
 
             if (ServerConfigurationManager.Configuration.IsStartupWizardCompleted)
             {