diff --git a/sp-modules/roundcube/module.nix b/sp-modules/roundcube/module.nix
index 73f6388..5ca2351 100644
--- a/sp-modules/roundcube/module.nix
+++ b/sp-modules/roundcube/module.nix
@@ -109,10 +109,10 @@ in
       '';
       systemd.services.roundcube = {
         after = [ auth-passthru.oauth2-systemd-service ];
-        requires = [ auth-passthru.oauth2-systemd-service ];
+        requires = [ auth-passthru.oauth2-systemd-service "dovecot2.service" ];
       };
       systemd.services.kanidm = {
-        serviceConfig.ExecStartPre = lib.mkBefore [
+        serviceConfig.ExecStartPre = lib.mkAfter [
           ("-+" + kanidmExecStartPreScriptRoot)
         ];
       };
diff --git a/sp-modules/simple-nixos-mailserver/auth-dovecot.nix b/sp-modules/simple-nixos-mailserver/auth-dovecot.nix
index 0e9235d..f5fd44d 100644
--- a/sp-modules/simple-nixos-mailserver/auth-dovecot.nix
+++ b/sp-modules/simple-nixos-mailserver/auth-dovecot.nix
@@ -137,7 +137,7 @@ in
     serviceConfig.RuntimeDirectory = lib.mkForce [ runtime-directory ];
   };
 
-  systemd.services.kanidm.serviceConfig.ExecStartPre = lib.mkAfter [
+  systemd.services.kanidm.serviceConfig.ExecStartPre = lib.mkBefore [
     ("-" + oauth-secret-ExecStartPreScript)
   ];
   # does it merge with existing restartTriggers?