diff --git a/services/nixarr/default.nix b/services/nixarr/default.nix
index 4d66383..89c25ea 100644
--- a/services/nixarr/default.nix
+++ b/services/nixarr/default.nix
@@ -89,22 +89,45 @@ in {
       prometheus.exporters = {
         exportarr-prowlarr = {
           enable = true;
-          apiKeyFile = "${config.age.secrets.nixarr-prowlarr-apiKeyFile.path}";
+          user = "exportarr";
+          group = "users";
+          environment = {
+            API_KEY_FILE = "/run/agenix/nixarr-prowlarr-apiKeyFile";
+          };
+          apiKeyFile = "/run/agenix/nixarr-prowlarr-apiKeyFile";
+          extraFlags = [
+            "--api-key-file /run/agenix/nixarr-prowlarr-apiKeyFile"
+          ];
           openFirewall = true;
         };
         exportarr-bazarr = {
           enable = true;
-          apiKeyFile = "${config.age.secrets.nixarr-bazarr-apiKeyFile.path}";
+          user = "exportarr";
+          group = "users";
+          apiKeyFile = "/run/agenix/nixarr-bazarr-apiKeyFile";
+          extraFlags = [
+            "--api-key-file /run/agenix/nixarr-bazarr-apiKeyFile"
+          ];
           openFirewall = true;
         };
         exportarr-sonarr = {
           enable = true;
-          apiKeyFile = "${config.age.secrets.nixarr-sonarr-apiKeyFile.path}";
+          user = "exportarr";
+          group = "users";
+          apiKeyFile = "/run/agenix/nixarr-sonarr-apiKeyFile";
+          extraFlags = [
+            "--api-key-file /run/agenix/nixarr-sonarr-apiKeyFile"
+          ];
           openFirewall = true;
         };
         exportarr-radarr = {
           enable = true;
-          apiKeyFile = "${config.age.secrets.nixarr-radarr-apiKeyFile.path}";
+          user = "exportarr";
+          group = "users";
+          apiKeyFile = "/run/agenix/nixarr-radarr-apiKeyFile";
+          extraFlags = [
+            "--api-key-file /run/agenix/nixarr-radarr-apiKeyFile"
+          ];
           openFirewall = true;
         };
       };