diff --git a/cluster/services/certificates/internal-wildcard.nix b/cluster/services/certificates/internal-wildcard.nix
index 8e1c3ca..dca93b3 100644
--- a/cluster/services/certificates/internal-wildcard.nix
+++ b/cluster/services/certificates/internal-wildcard.nix
@@ -14,9 +14,9 @@ in
     dnsProvider = "exec";
     group = "nginx";
     postRun = ''
-      ${pkgs.acl}/bin/setfacl -Rb out/
+      ${pkgs.acl}/bin/setfacl -Rb .
       ${lib.concatStringsSep "\n" (
-        map (group: "${pkgs.acl}/bin/setfacl -Rm g:${group}:rX out/") extraGroups
+        map (group: "${pkgs.acl}/bin/setfacl -Rm g:${group}:rX .") extraGroups
       )}
     '';
   };