diff --git a/services/activitylog/pkg/service/http.go b/services/activitylog/pkg/service/http.go
index 3405d82e0f..d888b9052a 100644
--- a/services/activitylog/pkg/service/http.go
+++ b/services/activitylog/pkg/service/http.go
@@ -134,48 +134,48 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 				message = MessageResourceUpdated
 			}
 			ts = utils.TSToTime(ev.Timestamp)
-			vars, err = s.GetVars(ctx, WithResource(ev.FileRef, true), WithUser(ev.ExecutingUser.GetId(), ev.ExecutingUser.GetDisplayName()), WithSpace(toSpace(ev.FileRef)))
+			vars, err = s.GetVars(ctx, WithResource(ev.FileRef, true), WithUser(nil, ev.ExecutingUser, ev.ImpersonatingUser), WithSpace(toSpace(ev.FileRef)))
 		case events.FileTouched:
 			message = MessageResourceCreated
 			ts = utils.TSToTime(ev.Timestamp)
-			vars, err = s.GetVars(ctx, WithResource(ev.Ref, true), WithUser(ev.Executant, ""), WithSpace(toSpace(ev.Ref)))
+			vars, err = s.GetVars(ctx, WithResource(ev.Ref, true), WithUser(ev.Executant, nil, ev.ImpersonatingUser), WithSpace(toSpace(ev.Ref)))
 		case events.ContainerCreated:
 			message = MessageResourceCreated
 			ts = utils.TSToTime(ev.Timestamp)
-			vars, err = s.GetVars(ctx, WithResource(ev.Ref, true), WithUser(ev.Executant, ""), WithSpace(toSpace(ev.Ref)))
+			vars, err = s.GetVars(ctx, WithResource(ev.Ref, true), WithUser(ev.Executant, nil, ev.ImpersonatingUser), WithSpace(toSpace(ev.Ref)))
 		case events.ItemTrashed:
 			message = MessageResourceTrashed
 			ts = utils.TSToTime(ev.Timestamp)
-			vars, err = s.GetVars(ctx, WithTrashedResource(ev.Ref, ev.ID), WithUser(ev.Executant, ""), WithSpace(toSpace(ev.Ref)))
+			vars, err = s.GetVars(ctx, WithTrashedResource(ev.Ref, ev.ID), WithUser(ev.Executant, nil, ev.ImpersonatingUser), WithSpace(toSpace(ev.Ref)))
 		case events.ItemMoved:
 			switch isRename(ev.OldReference, ev.Ref) {
 			case true:
 				message = MessageResourceRenamed
-				vars, err = s.GetVars(ctx, WithResource(ev.Ref, false), WithOldResource(ev.OldReference), WithUser(ev.Executant, ""))
+				vars, err = s.GetVars(ctx, WithResource(ev.Ref, false), WithOldResource(ev.OldReference), WithUser(ev.Executant, nil, ev.ImpersonatingUser))
 			case false:
 				message = MessageResourceMoved
-				vars, err = s.GetVars(ctx, WithResource(ev.Ref, true), WithUser(ev.Executant, ""), WithSpace(toSpace(ev.Ref)))
+				vars, err = s.GetVars(ctx, WithResource(ev.Ref, true), WithUser(ev.Executant, nil, ev.ImpersonatingUser), WithSpace(toSpace(ev.Ref)))
 			}
 			ts = utils.TSToTime(ev.Timestamp)
 		case events.ShareCreated:
 			message = MessageShareCreated
 			ts = utils.TSToTime(ev.CTime)
-			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, ""), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
+			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, nil, nil), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
 		case events.ShareUpdated:
 			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() == ev.ItemID.GetSpaceId() {
 				continue
 			}
 			message = MessageShareUpdated
 			ts = utils.TSToTime(ev.MTime)
-			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, ""), WithTranslation(&t, loc, "field", ev.UpdateMask))
+			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, nil, nil), WithTranslation(&t, loc, "field", ev.UpdateMask))
 		case events.ShareRemoved:
 			message = MessageShareDeleted
 			ts = ev.Timestamp
-			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, ""), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
+			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, nil, nil), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
 		case events.LinkCreated:
 			message = MessageLinkCreated
 			ts = utils.TSToTime(ev.CTime)
-			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, ""))
+			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, nil, nil))
 		case events.LinkUpdated:
 			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() == ev.ItemID.GetSpaceId() {
 				continue
@@ -184,21 +184,21 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 			ts = utils.TSToTime(ev.MTime)
 			vars, err = s.GetVars(ctx,
 				WithResource(toRef(ev.ItemID), false),
-				WithUser(ev.Executant, ""),
+				WithUser(ev.Executant, nil, nil),
 				WithTranslation(&t, loc, "field", []string{ev.FieldUpdated}),
 				WithVar("token", ev.ItemID.GetOpaqueId(), ev.Token))
 		case events.LinkRemoved:
 			message = MessageLinkDeleted
 			ts = utils.TSToTime(ev.Timestamp)
-			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, ""))
+			vars, err = s.GetVars(ctx, WithResource(toRef(ev.ItemID), false), WithUser(ev.Executant, nil, nil))
 		case events.SpaceShared:
 			message = MessageSpaceShared
 			ts = ev.Timestamp
-			vars, err = s.GetVars(ctx, WithSpace(ev.ID), WithUser(ev.Executant, ""), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
+			vars, err = s.GetVars(ctx, WithSpace(ev.ID), WithUser(ev.Executant, nil, nil), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
 		case events.SpaceUnshared:
 			message = MessageSpaceUnshared
 			ts = ev.Timestamp
-			vars, err = s.GetVars(ctx, WithSpace(ev.ID), WithUser(ev.Executant, ""), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
+			vars, err = s.GetVars(ctx, WithSpace(ev.ID), WithUser(ev.Executant, nil, nil), WithSharee(ev.GranteeUserID, ev.GranteeGroupID))
 		}
 
 		if err != nil {
diff --git a/services/activitylog/pkg/service/response.go b/services/activitylog/pkg/service/response.go
index 0e790a2b92..72838bd29a 100644
--- a/services/activitylog/pkg/service/response.go
+++ b/services/activitylog/pkg/service/response.go
@@ -155,23 +155,31 @@ func WithTrashedResource(ref *provider.Reference, rid *provider.ResourceId) Acti
 }
 
 // WithUser sets the user variable for an Activity
-func WithUser(uid *user.UserId, username string) ActivityOption {
-	return func(_ context.Context, gwc gateway.GatewayAPIClient, vars map[string]interface{}) error {
-		if username == "" {
-			u, err := utils.GetUser(uid, gwc)
+func WithUser(uid *user.UserId, u *user.User, impersonator *user.User) ActivityOption {
+	return func(ctx context.Context, gwc gateway.GatewayAPIClient, vars map[string]interface{}) error {
+		var target *user.User
+		switch {
+		case impersonator != nil:
+			target = impersonator
+		case u != nil:
+			target = u
+		case uid != nil:
+			us, err := utils.GetUserWithContext(ctx, uid, gwc)
+			target = us
+
 			if err != nil {
-				vars["user"] = Actor{
-					ID:          uid.GetOpaqueId(),
+				target = &user.User{
+					Id:          uid,
 					DisplayName: "DeletedUser",
 				}
-				return err
 			}
-			username = u.GetUsername()
+		default:
+			return fmt.Errorf("no user provided")
 		}
 
 		vars["user"] = Actor{
-			ID:          uid.GetOpaqueId(),
-			DisplayName: username,
+			ID:          target.GetId().GetOpaqueId(),
+			DisplayName: target.GetDisplayName(),
 		}
 
 		return nil
diff --git a/services/postprocessing/pkg/postprocessing/postprocessing.go b/services/postprocessing/pkg/postprocessing/postprocessing.go
index 1a27bfd502..1ce3962357 100644
--- a/services/postprocessing/pkg/postprocessing/postprocessing.go
+++ b/services/postprocessing/pkg/postprocessing/postprocessing.go
@@ -12,17 +12,18 @@ import (
 
 // Postprocessing handles postprocessing of a file
 type Postprocessing struct {
-	ID          string
-	URL         string
-	User        *user.User
-	Filename    string
-	Filesize    uint64
-	ResourceID  *provider.ResourceId
-	Steps       []events.Postprocessingstep
-	Status      Status
-	Failures    int
-	InitiatorID string
-	Finished    bool
+	ID                string
+	URL               string
+	User              *user.User
+	ImpersonatingUser *user.User
+	Filename          string
+	Filesize          uint64
+	ResourceID        *provider.ResourceId
+	Steps             []events.Postprocessingstep
+	Status            Status
+	Failures          int
+	InitiatorID       string
+	Finished          bool
 
 	config config.Postprocessing
 }
@@ -97,13 +98,14 @@ func (pp *Postprocessing) next(current events.Postprocessingstep) interface{} {
 func (pp *Postprocessing) step(next events.Postprocessingstep) events.StartPostprocessingStep {
 	pp.Status.CurrentStep = next
 	return events.StartPostprocessingStep{
-		UploadID:      pp.ID,
-		URL:           pp.URL,
-		ExecutingUser: pp.User,
-		Filename:      pp.Filename,
-		Filesize:      pp.Filesize,
-		ResourceID:    pp.ResourceID,
-		StepToStart:   next,
+		UploadID:          pp.ID,
+		URL:               pp.URL,
+		ExecutingUser:     pp.User,
+		Filename:          pp.Filename,
+		Filesize:          pp.Filesize,
+		ResourceID:        pp.ResourceID,
+		StepToStart:       next,
+		ImpersonatingUser: pp.ImpersonatingUser,
 	}
 }
 
@@ -111,10 +113,11 @@ func (pp *Postprocessing) finished(outcome events.PostprocessingOutcome) events.
 	pp.Status.CurrentStep = events.PPStepFinished
 	pp.Status.Outcome = outcome
 	return events.PostprocessingFinished{
-		UploadID:      pp.ID,
-		ExecutingUser: pp.User,
-		Filename:      pp.Filename,
-		Outcome:       outcome,
+		UploadID:          pp.ID,
+		ExecutingUser:     pp.User,
+		Filename:          pp.Filename,
+		Outcome:           outcome,
+		ImpersonatingUser: pp.ImpersonatingUser,
 	}
 }
 
diff --git a/services/postprocessing/pkg/service/service.go b/services/postprocessing/pkg/service/service.go
index 5e1f03bbf9..13441567d9 100644
--- a/services/postprocessing/pkg/service/service.go
+++ b/services/postprocessing/pkg/service/service.go
@@ -95,14 +95,15 @@ func (pps *PostprocessingService) processEvent(e events.Event) error {
 	switch ev := e.Event.(type) {
 	case events.BytesReceived:
 		pp = &postprocessing.Postprocessing{
-			ID:          ev.UploadID,
-			URL:         ev.URL,
-			User:        ev.ExecutingUser,
-			Filename:    ev.Filename,
-			Filesize:    ev.Filesize,
-			ResourceID:  ev.ResourceID,
-			Steps:       pps.steps,
-			InitiatorID: e.InitiatorID,
+			ID:                ev.UploadID,
+			URL:               ev.URL,
+			User:              ev.ExecutingUser,
+			Filename:          ev.Filename,
+			Filesize:          ev.Filesize,
+			ResourceID:        ev.ResourceID,
+			Steps:             pps.steps,
+			InitiatorID:       e.InitiatorID,
+			ImpersonatingUser: ev.ImpersonatingUser,
 		}
 		next = pp.Init(ev)
 	case events.PostprocessingStepFinished:
@@ -124,13 +125,14 @@ func (pps *PostprocessingService) processEvent(e events.Event) error {
 			go func() {
 				time.Sleep(backoff)
 				retryEvent := events.StartPostprocessingStep{
-					UploadID:      pp.ID,
-					URL:           pp.URL,
-					ExecutingUser: pp.User,
-					Filename:      pp.Filename,
-					Filesize:      pp.Filesize,
-					ResourceID:    pp.ResourceID,
-					StepToStart:   pp.Status.CurrentStep,
+					UploadID:          pp.ID,
+					URL:               pp.URL,
+					ExecutingUser:     pp.User,
+					Filename:          pp.Filename,
+					Filesize:          pp.Filesize,
+					ResourceID:        pp.ResourceID,
+					StepToStart:       pp.Status.CurrentStep,
+					ImpersonatingUser: pp.ImpersonatingUser,
 				}
 				err := events.Publish(ctx, pps.pub, retryEvent)
 				if err != nil {