diff --git a/lib/fudo/mail/dkim.nix b/lib/fudo/mail/dkim.nix
index 69a3704..0874c69 100644
--- a/lib/fudo/mail/dkim.nix
+++ b/lib/fudo/mail/dkim.nix
@@ -99,17 +99,19 @@ in {
       };
     };
 
-    systemd.services.opendkim = {
-      preStart = lib.mkForce createAllCerts;
-      serviceConfig = {
-        ExecStart = lib.mkForce
-          "${cfg.dkim.package}/bin/opendkim ${escapeShellArgs args}";
-        PermissionsStartOnly = lib.mkForce false;
+    systemd = {
+      tmpfiles.rules = [
+        "d '${cfg.dkim.key-directory}' - ${config.services.opendkim.user} ${config.services.opendkim.group} - -"
+      ];
+      services.opendkim = {
+        preStart = lib.mkForce createAllCerts;
+        serviceConfig = {
+          ExecStart = lib.mkForce
+            "${cfg.dkim.package}/bin/opendkim ${escapeShellArgs args}";
+          PermissionsStartOnly = lib.mkForce false;
+          ReadWritePaths = [ cfg.dkim.key-directory ];
+        };
       };
     };
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dkim.key-directory}' - ${config.services.opendkim.user} ${config.services.opendkim.group} - -"
-    ];
   };
 }