diff --git a/services/soulseek.nix b/services/soulseek.nix
index 02d4684..4cdd268 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -6,13 +6,24 @@
   username,
   ...
 }:
+let
+  slskd_env = "/etc/slskd_env";
+in
 {
   users.groups."music" = { };
 
+  system.activationScripts = {
+    "zfs-key".text = ''
+      #!/bin/sh
+      rm -fr ${slskd_env} || true
+      cp ${../secrets/slskd_env} ${slskd_env}
+    '';
+  };
+
   services.slskd = {
     enable = true;
     domain = null; # null so we don't use nginx reverse proxy
-    environmentFile = ../secrets/slskd_env;
+    environmentFile = slskd_env;
 
     settings = {
       web = {