diff --git a/hosts/pinwheel/modules/work/default.nix b/hosts/pinwheel/modules/work/default.nix
index 6411bff..10cb83f 100644
--- a/hosts/pinwheel/modules/work/default.nix
+++ b/hosts/pinwheel/modules/work/default.nix
@@ -116,6 +116,13 @@ EOF
     };
   };
 
+  # Ensure ~/code/work is owned by alex; it was previously created as root by
+  # agenix when secrets had a custom path there.
+  systemd.tmpfiles.rules = [
+    "d /home/alex/code 0755 alex users -"
+    "d /home/alex/code/work 0755 alex users -"
+  ];
+
   # Needed for `copilot`
   programs.nix-ld.enable = true;
   programs.nix-ld.libraries = [
@@ -138,21 +145,18 @@ EOF
   age.secrets = {
     "work-gitconfig" = lib.mkIf gitEnabled {
       file = ../../../../secrets/pinwheel/work-gitconfig.age;
-      path = "/home/alex/code/work/.work-gitconfig";
       owner = "alex";
       group = "users";
     };
 
     "work-github-token" = lib.mkIf gitEnabled {
       file = ../../../../secrets/pinwheel/work-github-token.age;
-      path = "/home/alex/code/work/.work-github-token";
       owner = "alex";
       group = "users";
     };
 
     "work-go-private" = lib.mkIf goEnabled {
       file = ../../../../secrets/pinwheel/work-go-private.age;
-      path = "/home/alex/code/work/.work-go-private";
       owner = "alex";
       group = "users";
     };