diff --git a/modules/llama-swap.nix b/modules/llama-swap.nix
index 0ff49d6..84395c3 100644
--- a/modules/llama-swap.nix
+++ b/modules/llama-swap.nix
@@ -2,6 +2,8 @@
   config,
   pkgs,
   lib,
+  inputs,
+  system,
   ...
 }:
 {
@@ -19,8 +21,8 @@
 
   services.llama-swap = {
     enable = true;
-    package = pkgs.unstable.llama-swap;
-    port = 11111;
+    package = inputs.self.packages.${system}.llama-swap;
+    port = 11112;
     openFirewall = true;
 
     settings =
@@ -135,17 +137,20 @@
   # system service HOME may default to "/" ("//.cache/..."), which is often
   # read-only. Give it a writable cache/state location.
   systemd.services.llama-swap = {
+    after = [ "sops-nix.service" ];
+    wants = [ "sops-nix.service" ];
     preStart = ''
-      cat > /run/llama-swap/secrets.env <<EOF
-      OPENAI_API_KEY=$(cat ${config.sops.secrets."ai/openai".path})
-      OPENROUTER_API_KEY=$(cat ${config.sops.secrets."ai/openrouter".path})
-      FIREWORKS_API_KEY=$(cat ${config.sops.secrets."ai/fireworks".path})
-      CEREBRAS_API_KEY=$(cat ${config.sops.secrets."ai/cerebras".path})
-      GROQ_API_KEY=$(cat ${config.sops.secrets."ai/groq".path})
-      MISTRAL_API_KEY=$(cat ${config.sops.secrets."ai/mistral".path})
-      ZAI_API_KEY=$(cat ${config.sops.secrets."ai/zai".path})
-      ZAI_API_BASE=https://api.z.ai/api/coding/paas/v4
-      EOF
+      set -eu
+      {
+        echo "OPENAI_API_KEY=$(cat ${config.sops.secrets."ai/openai".path})"
+        echo "OPENROUTER_API_KEY=$(cat ${config.sops.secrets."ai/openrouter".path})"
+        echo "FIREWORKS_API_KEY=$(cat ${config.sops.secrets."ai/fireworks".path})"
+        echo "CEREBRAS_API_KEY=$(cat ${config.sops.secrets."ai/cerebras".path})"
+        echo "GROQ_API_KEY=$(cat ${config.sops.secrets."ai/groq".path})"
+        echo "MISTRAL_API_KEY=$(cat ${config.sops.secrets."ai/mistral".path})"
+        echo "ZAI_API_KEY=$(cat ${config.sops.secrets."ai/zai".path})"
+        echo "ZAI_API_BASE=https://api.z.ai/api/coding/paas/v4"
+      } > /run/llama-swap/secrets.env
     '';
     serviceConfig = {
       StateDirectory = "llama-swap";