diff --git a/paris-container.nix b/paris-container.nix
index 5a289b5..f6a85fe 100644
--- a/paris-container.nix
+++ b/paris-container.nix
@@ -212,7 +212,7 @@ in {
           "LDAP_DEFAULT_AUTHTOKEN=${readFile cfg.ldap.bind-token-file}";
         target-file = "/run/paris/sssd.env";
       };
-      parisKeytab = {
+      parisKeytab = mkIf (!isNull cfg.kerberos) {
         source-file = cfg.kerberos.keytab;
         target-file = "/run/paris/keytab";
       };