diff --git a/nixos/common/global/age.nix b/nixos/common/global/age.nix
index 9020ce9..1c34019 100644
--- a/nixos/common/global/age.nix
+++ b/nixos/common/global/age.nix
@@ -12,13 +12,14 @@ in
     rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
     # Pubkey for rekeying
     rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
-    # As user not a trusted-users in our nix.conf
-    # we must add age.rekey.cacheDir as a global extra sandbox path
+    # Where we store the rekeyed secrets
     rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
   };
-
   # Required to persist `/var/tmp/agenix-rekey`
   environment.persistence."/persist".directories = [
     { directory = "/var/tmp/agenix-rekey"; mode = "1777"; }
   ];
+  # As user not a trusted-users in our nix.conf
+  # we must add age.rekey.cacheDir as a global extra sandbox path
+  nix.settings.extra-sandbox-paths = [ "/var/tmp/agenix-rekey" ];
 }