diff --git a/hosts/bucur.nix b/hosts/bucur.nix
index beaa7c9..0cc416d 100644
--- a/hosts/bucur.nix
+++ b/hosts/bucur.nix
@@ -5,6 +5,11 @@
   i18n.defaultLocale = "en_US.UTF-8";
   system.stateVersion = "25.11";
 
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
+  boot.loader.efi.canTouchEfiVariables = false;
+
   virtualisation.vmVariant = {
     users.mutableUsers = false;
     users.users.tobias.password = "admin";
diff --git a/modules/services/podman.nix b/modules/services/podman.nix
index c884261..cb1d6b7 100644
--- a/modules/services/podman.nix
+++ b/modules/services/podman.nix
@@ -1,8 +1,11 @@
 { config, ... }:
 {
-  environment.etc."sops/age/keys.txt".source = ../../secrets/age/keys.txt;
   sops.defaultSopsFile = ../../secrets/bucur.yaml;
-  sops.age.keyFile = "/etc/sops/age/keys.txt";
+  sops.age.keyFile = "/var/lib/sops/age/keys.txt";
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/sops/age 0700 root root -"
+  ];
 
   sops.secrets.mtproto_secret = {};