diff --git a/base.nix b/base.nix
index d5bdea6..ffb909d 100644
--- a/base.nix
+++ b/base.nix
@@ -60,8 +60,9 @@
   #system.switch.enable = false;
   #system.switch.enableNg = true; # rewritten in rust
 
+  sops.secrets.nix-access-tokens = {};
   sops.secrets.nix-access-tokens-all.mode = "0440";
-  sops.secrets.nix-access-tokens-all.group = config.users.groups.keys.name;
+  sops.secrets.nix-access-tokens-all.group = config.users.groups."keys".name;
   nix.extraOptions = ''
     !include ${config.sops.secrets.nix-access-tokens.path}
     !include ${config.sops.secrets.nix-access-tokens-all.path}