diff --git a/configuration.nix b/configuration.nix
index 1d6f4f5..115e237 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -86,6 +86,8 @@ in
     };
   };
 
+  services.logrotate.checkConfig = false; # seems to be broken with hardened profile.
+
   services.do-agent.enable =
     if config.selfprivacy.server.provider == "DIGITALOCEAN" then true else false;