diff --git a/migrations/0001_initial.up.sql b/migrations/0001_initial.up.sql
index a6dceeb..711115c 100644
--- a/migrations/0001_initial.up.sql
+++ b/migrations/0001_initial.up.sql
@@ -16,7 +16,7 @@ CREATE TABLE
         parent_folder_id UUID REFERENCES folders (folder_id) ON DELETE CASCADE DEFAULT null,
         owner_id INT REFERENCES users (user_id) ON DELETE CASCADE NOT NULL,
         folder_name VARCHAR(255) NOT NULL,
-        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
+        created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP NOT NULL
     );
 
 CREATE TABLE
@@ -26,8 +26,8 @@ CREATE TABLE
         file_name VARCHAR(255) NOT NULL,
         file_size BIGINT NOT NULL,
         sha512 BYTEA NOT NULL,
-        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL,
-        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
+        created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP NOT NULL,
+        updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP NOT NULL
     );
 
 CREATE TYPE permission AS ENUM ('read', 'write', 'manage');
diff --git a/sql/create_folder.sql b/sql/create_folder.sql
new file mode 100644
index 0000000..086e43d
--- /dev/null
+++ b/sql/create_folder.sql
@@ -0,0 +1,3 @@
+INSERT INTO folders(parent_folder_id, owner_id, folder_name)
+SELECT $1, owner_id, $2 FROM folders WHERE parent_folder_id = $1
+RETURNING folder_id
\ No newline at end of file
diff --git a/src/db/file.rs b/src/db/file.rs
index 7edae15..e612692 100644
--- a/src/db/file.rs
+++ b/src/db/file.rs
@@ -35,8 +35,8 @@ pub struct FileWithoutParentId {
     pub file_name: String,
     pub file_size: i64,
     pub sha512: String,
-    pub created_at: chrono::NaiveDateTime,
-    pub updated_at: chrono::NaiveDateTime,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
 }
 
 pub fn get_files(
diff --git a/src/db/folder.rs b/src/db/folder.rs
index c6f92e0..138e633 100644
--- a/src/db/folder.rs
+++ b/src/db/folder.rs
@@ -45,7 +45,7 @@ pub struct FolderWithoutParentId {
     pub folder_id: Uuid,
     pub owner_id: i32,
     pub folder_name: String,
-    pub created_at: chrono::NaiveDateTime,
+    pub created_at: chrono::DateTime<chrono::Utc>,
 }
 
 pub async fn get_by_id(
@@ -87,17 +87,9 @@ pub async fn name_exists(parent_folder_id: Uuid, name: &str, pool: &Pool) -> sql
         .map(|row| row.exists.unwrap_or(false))
 }
 
-pub async fn insert(
-    parent_folder_id: Uuid,
-    user_id: i32,
-    folder_name: &str,
-    pool: &Pool,
-) -> sqlx::Result<Uuid> {
-    sqlx::query!("INSERT INTO folders(parent_folder_id, owner_id, folder_name) VALUES ($1, $2, $3) RETURNING folder_id", 
-            parent_folder_id,
-            user_id,
-            folder_name
-        )
+/// Creates a folder in the database. Do not use this function to create the ROOT folder
+pub async fn insert(parent_folder_id: Uuid, folder_name: &str, pool: &Pool) -> sqlx::Result<Uuid> {
+    sqlx::query_file!("sql/create_folder.sql", parent_folder_id, folder_name)
         .fetch_one(pool)
         .await
         .map(|record| record.folder_id)
diff --git a/src/endpoints/folder/create.rs b/src/endpoints/folder/create.rs
index f9c0a42..1835781 100644
--- a/src/endpoints/folder/create.rs
+++ b/src/endpoints/folder/create.rs
@@ -23,14 +23,9 @@ pub async fn create(
         return Err(StatusCode::CONFLICT);
     }
 
-    let id = db::folder::insert(
-        params.parent_folder_id,
-        claims.user_id,
-        &params.folder_name,
-        &pool,
-    )
-    .await
-    .handle_internal()?;
+    let id = db::folder::insert(params.parent_folder_id, &params.folder_name, &pool)
+        .await
+        .handle_internal()?;
 
     Ok(Json(id))
 }
diff --git a/src/main.rs b/src/main.rs
index 67c743b..09c504e 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -80,10 +80,8 @@ fn app(state: AppState) -> Router {
     };
     use tower_http::ServiceBuilderExt as _;
 
-    let sensitive_headers = [header::AUTHORIZATION, header::COOKIE];
-
     let middleware = tower::ServiceBuilder::new()
-        .sensitive_headers(sensitive_headers)
+        .sensitive_headers([header::AUTHORIZATION, header::COOKIE])
         .trace_for_http()
         .compression();