diff --git a/modules/servers/keycloak.nix b/modules/servers/keycloak.nix
index 8f4af18..735442e 100644
--- a/modules/servers/keycloak.nix
+++ b/modules/servers/keycloak.nix
@@ -13,14 +13,9 @@ in
   config = lib.mkIf (cfg.enable && config.my.secureHost) {
     sops.secrets.keycloak = {
       sopsFile = ../../secrets/env.yaml;
-      owner = "keycloak";
-      group = "keycloak";
-    };
-    sops.secrets.postgres-password = {
-      sopsFile = ../../secrets/secrets.yaml;
-      owner = "keycloak";
-      group = "keycloak";
+      restartUnits = [ "keycloak.service" ];
     };
+    sops.secrets.postgres-password.sopsFile = ../../secrets/secrets.yaml;
     services.keycloak = {
       inherit (cfg) enable;
       database = {