diff --git a/module.nix b/module.nix
index 38f1241..15db5e6 100644
--- a/module.nix
+++ b/module.nix
@@ -138,10 +138,10 @@ in
         unitConfig.RequiresMountsFor = lib.mkIf sp.useBinds "/volumes/${cfg.location}/mastodon";
         serviceConfig = {
           loadCredentials = ["client-secret:${oauthClientSecretFP}"];
-          ExecStart = lib.mkForce pkgs.writeShellScript "run-mastodon-with-client-secret" ''
+          ExecStart = lib.mkForce (pkgs.writeShellScript "run-mastodon-with-client-secret" ''
             export CLIENT_SECRET=$(cat $CREDENTIALS_DIRECTORY/client-secret)
             ${config.services.mastodon.package}/bin/puma -C config/puma.rb`
-          '';
+          '');
         };
         environment = {
           OIDC_ENABLED = "true";