diff --git a/profiles/wireguard-server/default.nix b/profiles/wireguard-server/default.nix
index 8a5eaffe..7a15fd67 100644
--- a/profiles/wireguard-server/default.nix
+++ b/profiles/wireguard-server/default.nix
@@ -13,7 +13,8 @@
   networking.wireguard.interfaces.wg0 = {
     ips = [ "10.0.69.1/24" ];
     listenPort = 60990;
-    privateKeyFile = "/var/lib/wireguard/priv";
+    privateKeyFile = "/var/lib/wireguard/private";
+    generatePrivateKeyFile = true; # TODO agenix secret
     peers = [
       {
         # box