diff --git a/module.nix b/module.nix
index e9f322b..3de0c6c 100644
--- a/module.nix
+++ b/module.nix
@@ -95,7 +95,8 @@ in
       // lib.mapAttrs (_: v: toString v) cfg.settings;
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${lib.getExe pkgs.mail-quota-warning}${lib.optionalString (cfg.secretFile != null) " --config ${cfg.secretFile}"}";
+        LoadCredential = lib.optionalString (cfg.secretFile != null) "secrets.yaml:${cfg.secretFile}";
+        ExecStart = "${lib.getExe pkgs.mail-quota-warning}${lib.optionalString (cfg.secretFile != null) " --config \${CREDENTIALS_DIRECTORY}/secrets.yaml";
         WorkingDirectory = "%S/mail-quota-warning";
         StateDirectory = "mail-quota-warning";