diff --git a/services/vm/mastodon-vm.nix b/services/vm/mastodon-vm.nix
index 5a9734b..b9d28b1 100644
--- a/services/vm/mastodon-vm.nix
+++ b/services/vm/mastodon-vm.nix
@@ -20,7 +20,7 @@
         streamingProcesses = lib.max 1 (config.virtualisation.cores - 1);
       };
 
-      security.acme = {
+      security.acme = lib.mkVMOverride {
         defaults = {
           # invalid server; the systemd service will fail, and we won't get
           # properly signed certificates. but let's not spam the letsencrypt