diff --git a/flakes/secrets-bao/nixos-module.nix b/flakes/secrets-bao/nixos-module.nix
index 3931f585..5d337257 100644
--- a/flakes/secrets-bao/nixos-module.nix
+++ b/flakes/secrets-bao/nixos-module.nix
@@ -541,17 +541,17 @@ in
              }
            ) cfg.secrets)
            // {
-             openbao-zitadel-jwt = {
-               description = "React to Zitadel JWT changes (restart vault-agent)";
-               wantedBy = [ "multi-user.target" ];
+              openbao-zitadel-jwt = {
+                description = "React to Zitadel JWT changes (restart vault-agent)";
+                wantedBy = [ "multi-user.target" ];
 
-               pathConfig = {
-                 PathChanged = cfg.zitadelJwtPath;
-                 Unit = "openbao-jwt-changed.service";
-                 TriggerLimitIntervalSec = 30;
-                 TriggerLimitBurst = 3;
-               };
-             };
+                pathConfig = {
+                  PathModified = cfg.zitadelJwtPath;
+                  Unit = "openbao-jwt-changed.service";
+                  TriggerLimitIntervalSec = 30;
+                  TriggerLimitBurst = 3;
+                };
+              };
 
               openbao-secrets-ready = {
                 description = "Re-check OpenBao secrets readiness";