diff --git a/dkim.nix b/dkim.nix
index fd0f994..fb4e4f9 100644
--- a/dkim.nix
+++ b/dkim.nix
@@ -91,8 +91,10 @@ in {
       in [ "d ${cfg.state-directory} 0700 ${user} ${group} - -" ];
       services.opendkim = {
         serviceConfig = {
-          ExecStartPre = pkgs.writeShellScript "ensure-dkim-certs.sh"
-            (ensureAllDkimCerts cfg.state-directory cfg.domains);
+          ExecStartPre = [
+            (pkgs.writeShellScript "ensure-dkim-certs.sh"
+              (ensureAllDkimCerts cfg.state-directory cfg.domains))
+          ];
           ReadWritePaths = [ cfg.state-directory ];
         };
       };