diff --git a/nixos/modules/containers.nix b/nixos/modules/containers.nix
index bf340e2..3c766a9 100644
--- a/nixos/modules/containers.nix
+++ b/nixos/modules/containers.nix
@@ -265,6 +265,7 @@ in
         };
 
         # age requires all keys to at least exist, even if they're not going to be used
+        agenixMountSecrets.deps = [ "ensureDevKey" ];
         ensureDevKey.text =
         ''
           [ ! -e "${devVMKeyPath}" ] && touch "${devVMKeyPath}"
diff --git a/nixos/modules/secrets.nix b/nixos/modules/secrets.nix
index a2c2905..17c02f0 100644
--- a/nixos/modules/secrets.nix
+++ b/nixos/modules/secrets.nix
@@ -26,7 +26,7 @@ in
             # Use the persit dir to grab the keys instead, otherwise they might not be ready. We can't really make
             # agenix depend on impermanence, since users depends on agenix (to decrypt passwords) and impermanence
             # depends on users
-            (e: let pDir = config.my.tmproot.persistence.dir; in if pDir != null then "${pDir}/${e.path}" else e.path)
+            (e: let pDir = config.my.tmproot.persistence.dir; in if pDir != null then "${pDir}${e.path}" else e.path)
             (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys));
       };
     }