diff --git a/lib/fudo/auth/kerberos/kdc.nix b/lib/fudo/auth/kerberos/kdc.nix
index 4733b85..1b80014 100644
--- a/lib/fudo/auth/kerberos/kdc.nix
+++ b/lib/fudo/auth/kerberos/kdc.nix
@@ -99,7 +99,7 @@ let
                 SecureBits = "keep-caps";
                 ExecStartPre = ''
                   chown ${cfg.user}:${cfg.group} ${cfg.kdc.database}
-                  chown ${cfg.user}:${cfg.group} ${cfg.state-directory}/kerberos.log
+                  chown ${cfg.user}:${cfg.group} ${cfg.kdc.state-directory}/kerberos.log
                 '';
                 ExecStart = let
                   ips = if (cfg.kdc.bind-addresses != [ ]) then