diff --git a/flake.lock b/flake.lock
index 7abc6b6..7cfc478 100644
--- a/flake.lock
+++ b/flake.lock
@@ -288,11 +288,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1729413321,
-        "narHash": "sha256-I4tuhRpZFa6Fu6dcH9Dlo5LlH17peT79vx1y1SpeKt0=",
+        "lastModified": 1729665710,
+        "narHash": "sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1997e4aa514312c1af7e2bda7fad1644e778ff26",
+        "rev": "2768c7d042a37de65bb1b5b3268fc987e534c49d",
         "type": "github"
       },
       "original": {
diff --git a/hosts/hydra-1/nix-cache.nix b/hosts/hydra-1/nix-cache.nix
index 17a8b96..601b8f4 100644
--- a/hosts/hydra-1/nix-cache.nix
+++ b/hosts/hydra-1/nix-cache.nix
@@ -5,18 +5,10 @@
   services.harmonia = {
     enable = true;
     settings.bind = "[::1]:5005";
-  };
-
-  systemd.services.harmonia = {
-    environment = {
-      SIGN_KEY_PATHS = "%d/key1 %d/key2";
-    };
-    serviceConfig = {
-      LoadCredential = [
-        "key1:${config.sops.secrets."sign-key-nix-cache.clerie.de".path}"
-        "key2:${config.sops.secrets."sign-key-cache.nix.clerie.de".path}"
-      ];
-    };
+    signKeyPaths = [
+      config.sops.secrets."sign-key-nix-cache.clerie.de".path
+      config.sops.secrets."sign-key-cache.nix.clerie.de".path
+    ];
   };
 
   services.nginx.virtualHosts = {