diff --git a/modules/ppp/common.nix b/modules/ppp/common.nix
index 33f79efd..1eae864d 100644
--- a/modules/ppp/common.nix
+++ b/modules/ppp/common.nix
@@ -78,6 +78,6 @@ let
     inherit dependencies;
   };
 in svc.secrets.subscriber.build {
-  watch = [ username password ];
+  watch = lib.filter (n: typeOf n=="lambda") [ username password ];
   inherit service;
 }
diff --git a/modules/ppp/default.nix b/modules/ppp/default.nix
index fdbe121b..b78a998e 100644
--- a/modules/ppp/default.nix
+++ b/modules/ppp/default.nix
@@ -25,6 +25,7 @@ let
       inherit description;
     };
 in {
+  imports = [ ../secrets ];
   options = {
     system.service.pppoe = mkOption {
       type = liminix.lib.types.serviceDefn;
diff --git a/modules/secrets/subscriber.nix b/modules/secrets/subscriber.nix
index 0877c865..14f7675f 100644
--- a/modules/secrets/subscriber.nix
+++ b/modules/secrets/subscriber.nix
@@ -5,7 +5,7 @@
 let
   inherit (liminix.services) oneshot longrun;
   inherit (builtins) length head toString;
-  inherit (lib) unique optional;
+  inherit (lib) unique optional optionals;
   inherit (service) name;
 
   watched-services = unique (map (f: f "service") watch);
@@ -46,6 +46,6 @@ in service.overrideAttrs(o: {
   buildInputs =  (lim.orEmpty o.buildInputs) ++
                  optional (watched-service != null) watcher;
   dependencies = (lim.orEmpty o.dependencies) ++
-                 optional (watched-service != null)  watcher ++
-                 optional (watched-service != null)  watched-service;
+                 optionals (watched-service != null)
+                   [ watcher watched-service ];
 })