diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix
index 4b57643e4090..ee3c1a5d8232 100644
--- a/nixos/modules/services/matrix/matrix-authentication-service.nix
+++ b/nixos/modules/services/matrix/matrix-authentication-service.nix
@@ -45,7 +45,9 @@ let
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
 
-  extraConfigFiles = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles;
+  extraConfigFiles = lib.imap0 (
+    i: _: "\${CREDENTIALS_DIRECTORY}/config-${toString i}"
+  ) cfg.extraConfigFiles;
   runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {
diff --git a/nixos/tests/matrix/matrix-authentication-service.nix b/nixos/tests/matrix/matrix-authentication-service.nix
index 9194b1fc56cd..19900b5a9c18 100644
--- a/nixos/tests/matrix/matrix-authentication-service.nix
+++ b/nixos/tests/matrix/matrix-authentication-service.nix
@@ -189,11 +189,26 @@ in
       { nodes, ... }:
       let
         bundle = mkBundle masDomain;
+
+        extraConfig = pkgs.writeText "masExtraConfig.yml" (
+          builtins.toJSON {
+            secrets = {
+              encryption_file = "/var/lib/matrix-authentication-service/encryption";
+              keys = [
+                {
+                  kid = "rsa-4096";
+                  key_file = "/var/lib/matrix-authentication-service/key_rsa_4096";
+                }
+              ];
+            };
+          }
+        );
       in
       {
         services.matrix-authentication-service = {
           enable = true;
           createDatabase = true;
+          extraConfigFiles = [ (toString extraConfig) ];
           settings = {
             http = {
               public_base = "https://${masDomain}:8080/";
@@ -223,15 +238,7 @@ in
               secret_file = "/var/lib/matrix-authentication-service/matrix_secret";
             };
             database.uri = "postgresql:///matrix-authentication-service?host=/run/postgresql&user=matrix-authentication-service";
-            secrets = {
-              encryption_file = "/var/lib/matrix-authentication-service/encryption";
-              keys = [
-                {
-                  kid = "rsa-4096";
-                  key_file = "/var/lib/matrix-authentication-service/key_rsa_4096";
-                }
-              ];
-            };
+            # secrets is defined in extraConfigFiles
             policy.data.client_registration.allow_insecure_uris = true;
             upstream_oauth2.providers = [
               {