diff --git a/pkgs/liminix-tools/services/builder.sh b/pkgs/liminix-tools/services/builder.sh
index 5edfa5d..e163fe0 100644
--- a/pkgs/liminix-tools/services/builder.sh
+++ b/pkgs/liminix-tools/services/builder.sh
@@ -11,7 +11,7 @@ test -n "$contents" && for d in $contents; do
     touch $out/${name}/contents.d/$d
 done
 
-for i in timeout-up timeout-down run notification-fd up down consumer-for producer-for pipeline-name restart-on-upgrade; do
+for i in timeout-up timeout-down run notification-fd up down finish consumer-for producer-for pipeline-name restart-on-upgrade; do
     test -n "$(printenv $i)" && (echo "$(printenv $i)" > $out/${name}/$i)
 done
 
diff --git a/pkgs/liminix-tools/services/default.nix b/pkgs/liminix-tools/services/default.nix
index 34c9b7e..c0dbaf0 100644
--- a/pkgs/liminix-tools/services/default.nix
+++ b/pkgs/liminix-tools/services/default.nix
@@ -18,6 +18,7 @@ let
     ${commands}
   '';
   cleanupScript = name : ''
+    #!/bin/sh
     if test -d ${prefix}/${name} ; then rm -rf ${prefix}/${name} ; fi
   '';
   service = {
@@ -26,6 +27,7 @@ let
     , run ? null
     , up ? null
     , down ? null
+    , finish ? null
     , outputs ? []
     , notification-fd ? null
     , producer-for ? null
@@ -41,7 +43,7 @@ let
     stdenvNoCC.mkDerivation {
       # we use stdenvNoCC to avoid generating derivations with names
       # like foo.service-mips-linux-musl
-      inherit name serviceType up down run notification-fd
+      inherit name serviceType up down run finish notification-fd
         producer-for consumer-for pipeline-name timeout-up timeout-down;
       restart-on-upgrade = isTrigger;
       buildInputs = buildInputs ++ dependencies ++ contents;
@@ -70,7 +72,8 @@ let
     in service (args // {
       buildInputs = buildInputs ++ [ logger ];
       serviceType = "longrun";
-      run = serviceScript "${run}\n${cleanupScript name}";
+      run = serviceScript run;
+      finish = cleanupScript name;
       producer-for = "${name}-log";
     });