diff --git a/modules/services/jirorian.nix b/modules/services/jirorian.nix
index dffd603..6c0855e 100644
--- a/modules/services/jirorian.nix
+++ b/modules/services/jirorian.nix
@@ -11,17 +11,17 @@ let
 
   pkg = inputs.jirorian.packages.${pkgs.system}.default;
 
-  # Writes an EnvironmentFile from sops-managed secret files at service start.
-  makeEnv = pkgs.writeShellScript "jirorian-make-env" ''
+  # Wrapper that exports secrets from sops-managed files then execs jirorian.
+  # EnvironmentFile cannot be used here because systemd loads it before
+  # ExecStartPre runs, so we read secrets inline in ExecStart instead.
+  startScript = pkgs.writeShellScript "jirorian-start" ''
     set -euo pipefail
-    install -m 0600 /dev/null /run/jirorian/env
-    {
-      echo "R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})"
-      echo "R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})"
-      echo "R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})"
-      echo "SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})"
-      echo "JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})"
-    } >> /run/jirorian/env
+    export R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})
+    export R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})
+    export R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})
+    export SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})
+    export JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})
+    exec ${pkg}/bin/jirorian
   '';
 in
 {
@@ -49,9 +49,7 @@ in
       Group = "jirorian";
       StateDirectory = "jirorian";
       RuntimeDirectory = "jirorian";
-      ExecStartPre = "+${makeEnv}";
-      ExecStart = "${pkg}/bin/jirorian";
-      EnvironmentFile = "/run/jirorian/env";
+      ExecStart = startScript;
       Environment = [
         "JIRORIAN_BASE_URL=https://${domain}"
         "JIRORIAN_PORT=${toString port}"