diff --git a/systems/x86_64-linux/marvin/services/pingvin-share.nix b/systems/x86_64-linux/marvin/services/pingvin-share.nix
index a0529393..d9d5cb7a 100644
--- a/systems/x86_64-linux/marvin/services/pingvin-share.nix
+++ b/systems/x86_64-linux/marvin/services/pingvin-share.nix
@@ -7,35 +7,34 @@
 let
   d = lib.py.data.services.pingvin-share;
   cfg = config.services.pingvin-share;
-  configFile = pkgs.py.pingvin-share-config.overrideAttrs {
-    settings = {
-      general = {
-        appName = "dishNet Files";
-        secureCookies = "true";
-      };
-      share = {
-        allowRegistration = "false";
-        allowUnauthenticatedShares = "false";
-      };
-      email.enableShareEmailRecipients = "true";
-      smtp = {
-        enabled = "true";
-        host = "mail.pyrox.dev";
-        port = "465";
-        email = "share@pyrox.dev";
-        username = "share@pyrox.dev";
-        password = "SMTP_PASSWORD";
-      };
-      ldap.enabled = "false";
-      legal.enabled = "false";
-      s3.enabled = "false";
-      initUser = {
-        enabled = true;
-        username = "dish";
-        email = "pyrox@pyrox.dev";
-        password = "ADMIN_PASSWORD";
-        isAdmin = true;
-      };
+  configFormat = pkgs.formats.yaml { };
+  configFile = configFormat.generate "config.yaml" {
+    general = {
+      appName = "dishNet Files";
+      secureCookies = "true";
+    };
+    share = {
+      allowRegistration = "false";
+      allowUnauthenticatedShares = "false";
+    };
+    email.enableShareEmailRecipients = "true";
+    smtp = {
+      enabled = "true";
+      host = "mail.pyrox.dev";
+      port = "465";
+      email = "share@pyrox.dev";
+      username = "share@pyrox.dev";
+      password = "SMTP_PASSWORD";
+    };
+    ldap.enabled = "false";
+    legal.enabled = "false";
+    s3.enabled = "false";
+    initUser = {
+      enabled = true;
+      username = "dish";
+      email = "pyrox@pyrox.dev";
+      password = "ADMIN_PASSWORD";
+      isAdmin = true;
     };
   };
 in
@@ -69,13 +68,14 @@ in
     enable = cfg.enable;
     description = "Pingvin Share configuration setup";
     wantedBy = [ "multi-user.target" ];
-    before = [ "pingvin-share.service" ];
+    before = [
+      "pingvin-share-backend.service"
+      "pingvin-share-frontend.service"
+    ];
     path = [ pkgs.gnused ];
     script = ''
       rm ${cfg.dataDir}/config.yaml
-      chmod o-rwx ${cfg.dataDir}/config.yaml
-      chmod ug-x ${cfg.dataDir}/config.yaml
-      cp ${configFile}/config.yaml ${cfg.dataDir}/config.yaml
+      cp ${configFile} ${cfg.dataDir}/config.yaml
       sed -i "s/SMTP_PASSWORD/$SMTP_PASSWORD/" ${cfg.dataDir}/config.yaml
       sed -i "s/ADMIN_PASSWORD/$ADMIN_PASSWORD/" ${cfg.dataDir}/config.yaml
     '';
@@ -83,7 +83,12 @@ in
       EnvironmentFile = config.age.secrets.pingvin-secrets.path;
       User = cfg.user;
       Group = cfg.group;
-      ReadWritePaths = [ "${cfg.dataDir}/config.yaml" ];
+      ReadWritePaths = [ "${cfg.dataDir}" ];
     };
   };
+  age.secrets.pingvin-secrets = {
+    file = ./secrets/pingvin-secrets.age;
+    owner = cfg.user;
+    group = cfg.group;
+  };
 }