diff --git a/morph/lib/monitoring.nix b/morph/lib/monitoring.nix
index 0cedcf6498e485a69075c964ce3d4064baeadcae..84d6fa561c43eca28286d9e0e97f6f86d18d5fb5 100644
--- a/morph/lib/monitoring.nix
+++ b/morph/lib/monitoring.nix
@@ -111,19 +111,19 @@ in {
         permissions = "0400";
         action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
         };
-      }
-      (lib.mkIf (cfg.googleOAuthClientID != "") {
-        "grafana-google-sso-secret" = {
-          source = "${privateKeyPath}/grafana-google-sso.secret";
-          destination = "/run/keys/grafana-google-sso.secret";
+        "grafana-admin-password" = {
+          source = "${privateKeyPath}/grafana-admin.password";
+          destination = "/run/keys/grafana-admin.password";
           owner.user = config.systemd.services.grafana.serviceConfig.User;
           owner.group = config.users.users.grafana.group;
           permissions = "0400";
           action = ["sudo" "systemctl" "restart" "grafana.service"];
         };
-        "grafana-admin-password" = {
-          source = "${privateKeyPath}/grafana-admin.password";
-          destination = "/run/keys/grafana-admin.password";
+      }
+      (lib.mkIf (cfg.googleOAuthClientID != "") {
+        "grafana-google-sso-secret" = {
+          source = "${privateKeyPath}/grafana-google-sso.secret";
+          destination = "/run/keys/grafana-google-sso.secret";
           owner.user = config.systemd.services.grafana.serviceConfig.User;
           owner.group = config.users.users.grafana.group;
           permissions = "0400";