diff --git a/flake.nix b/flake.nix
index c03d5d2..aa0caea 100644
--- a/flake.nix
+++ b/flake.nix
@@ -238,35 +238,29 @@
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
           {
             age.secrets = {
-              postgres-forgejo = {
-                file = ./secrets/postgres-forgejo.age;
-                owner = "forgejo";
-                group = "forgejo";
-                mode = "0400";
-              };
               forgejo-internal-token = {
                 file = ./secrets/forgejo-internal-token.age;
+                mode = "440";
                 owner = "forgejo";
                 group = "forgejo";
-                mode = "0440";
               };
               forgejo-secret-key = {
                 file = ./secrets/forgejo-secret-key.age;
+                mode = "440";
                 owner = "forgejo";
                 group = "forgejo";
-                mode = "0440";
               };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
+                mode = "444";
                 owner = "root";
                 group = "root";
-                mode = "0444";
               };
               forgejo-runner-token-snowden-env = {
                 file = ./secrets/forgejo-runner-token-snowden-env.age;
+                mode = "444";
                 owner = "root";
                 group = "root";
-                mode = "0444";
               };
             };
           }
diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index c358b1d..1a78101 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -51,7 +51,7 @@ in
         createDatabase = false;
         host = "sql.${config.networking.domain}";
         name = "git";
-        passwordFile = config.age.secrets.postgresql-forgejo.path;
+        passwordFile = config.age.secrets.postgresql_forgejo.path;
         port = 5432;
         user = "git";
         type = "postgres";