diff --git a/agenix/hosts/sail/config.nix b/agenix/hosts/sail/config.nix
index 8df4d1c..2d36498 100644
--- a/agenix/hosts/sail/config.nix
+++ b/agenix/hosts/sail/config.nix
@@ -95,7 +95,6 @@
 
     nitter-config = {
       file = ./nitter/config.age;
-      mode = "444";
     };
 
     nitter-auth = {
diff --git a/system/nixos/nitter.nix b/system/nixos/nitter.nix
index 345ec92..2d9da29 100644
--- a/system/nixos/nitter.nix
+++ b/system/nixos/nitter.nix
@@ -18,7 +18,8 @@ in
     serviceConfig = {
       DynamicUser = true;
       StateDirectory = "nitter";
-      Environment = [ "NITTER_CONF_FILE=${config.age.secrets.nitter-config.path}" ];
+      LoadCredential = [ "config:${config.age.secrets.nitter-config.path}" ];
+      Environment = [ "NITTER_CONF_FILE=%d/config" ];
       # Some parts of Nitter expect `public` folder in working directory,
       # see https://github.com/zedeus/nitter/issues/414
       WorkingDirectory = "${nitter-pkg}/share/nitter";