diff --git a/checks/secrets/default.nix b/checks/secrets/default.nix
index 97b9a7e4..f4bbbfac 100644
--- a/checks/secrets/default.nix
+++ b/checks/secrets/default.nix
@@ -4,10 +4,11 @@
   nodes.machine =
     { self, config, ... }:
     {
+      environment.etc."privkey.age".source = ./key.age;
       imports = [ (self.nixosModules.clanCore) ];
       environment.etc."secret".source = config.sops.secrets.secret.path;
       environment.etc."group-secret".source = config.sops.secrets.group-secret.path;
-      sops.age.keyFile = ./key.age;
+      sops.age.keyFile = "/etc/privkey.age";
 
       clanCore.clanDir = "${./.}";
       clanCore.machineName = "machine";