diff --git a/modules/nix/sops.nix b/modules/nix/sops.nix
index e0c3272..36f5725 100644
--- a/modules/nix/sops.nix
+++ b/modules/nix/sops.nix
@@ -39,6 +39,7 @@ in {
       // {
         # Use a pre-provisioned age key file on disk.
         age = defaultAgeConfig // {keyFile = "/var/lib/sops-nix/key.txt";};
+        useSystemdActivation = true;
       };
   };
 
diff --git a/modules/services/crowdsec.nix b/modules/services/crowdsec.nix
index 124c788..fbfe726 100644
--- a/modules/services/crowdsec.nix
+++ b/modules/services/crowdsec.nix
@@ -152,8 +152,14 @@
     systemd.services = {
       # keep-sorted start block=yes newline_separated=yes
       crowdsec = {
-        after = ["postgresql.service"];
-        requires = ["postgresql.service"];
+        after = [
+          "postgresql.service"
+          "sops-install-secrets.service"
+        ];
+        requires = [
+          "postgresql.service"
+          "sops-install-secrets.service"
+        ];
       };
 
       crowdsec-firewall-bouncer-register.serviceConfig.RestrictAddressFamilies = mkForce [
@@ -162,16 +168,28 @@
       ];
 
       crowdsec-setup = {
-        after = ["postgresql.service"];
-        requires = ["postgresql.service"];
+        after = [
+          "postgresql.service"
+          "sops-install-secrets.service"
+        ];
+        requires = [
+          "postgresql.service"
+          "sops-install-secrets.service"
+        ];
       };
 
       crowdsec-traefik-bouncer = {
-        after = ["crowdsec.service"];
+        after = [
+          "crowdsec.service"
+          "sops-install-secrets.service"
+        ];
         before = ["traefik.service"];
         description = "Register Traefik CrowdSec bouncer";
         requiredBy = ["traefik.service"];
-        requires = ["crowdsec.service"];
+        requires = [
+          "crowdsec.service"
+          "sops-install-secrets.service"
+        ];
 
         script = ''
           set -eu
diff --git a/modules/services/traefik.nix b/modules/services/traefik.nix
index bc071fe..b4b5060 100644
--- a/modules/services/traefik.nix
+++ b/modules/services/traefik.nix
@@ -105,6 +105,7 @@
         dynamicConfigOptions = {
           http = {
             middlewares = {
+              # keep-sorted start block=yes newline_separated=yes
               authentik.forwardAuth = {
                 address = "http://[::1]:9005/outpost.goauthentik.io/auth/traefik";
                 trustForwardHeader = true;
@@ -138,9 +139,11 @@
                 scheme = "https";
                 permanent = true;
               };
+              # keep-sorted end
             };
 
             routers = {
+              # keep-sorted start block=yes newline_separated=yes
               authentik = {
                 entryPoints = ["websecure"];
                 rule = "Host(`authentik.${groundDomain}`)";
@@ -160,6 +163,7 @@
                 rule = "Host(`traefik.${groundDomain}`)";
                 service = "api@internal";
               };
+              # keep-sorted end
             };
 
             services = {