diff --git a/nixos/modules/services/mail/opendkim.nix b/nixos/modules/services/mail/opendkim.nix
index f4d856944ec..9bf6f338d93 100644
--- a/nixos/modules/services/mail/opendkim.nix
+++ b/nixos/modules/services/mail/opendkim.nix
@@ -131,6 +131,7 @@ in {
         RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
         StateDirectory = "opendkim";
         StateDirectoryMode = "0700";
+        ReadWritePaths = [ cfg.keyPath ];
 
         AmbientCapabilities = [];
         CapabilityBoundingSet = [];