diff --git a/modules/system/vpns.nix b/modules/system/vpns.nix
index 3a86774..ce49bc5 100644
--- a/modules/system/vpns.nix
+++ b/modules/system/vpns.nix
@@ -32,7 +32,7 @@ in
         '';
       };
     };
-    sops.secrets = lib.mkIf cfg.openvpn_pia_mexico {
+    sops.secrets = lib.optionalAttrs cfg.openvpn_pia_mexico {
       "pia_auth" = { owner = "root"; group = "root"; };
       "openvpn_pia_mexico_config" = {owner = "root"; group = "root"; };
     };
@@ -56,7 +56,7 @@ in
     };
 
     # secrets only if VPN is enabled
-    sops.secrets = lib.mkIf cfg.wireguard_pia_mexico {
+    sops.secrets = lib.optionalAttrs cfg.wireguard_pia_mexico {
       "wg_pia_mexico_key" = { owner = "root"; group = "root"; };
     };
   };