diff --git a/cluster/services/sso/default.nix b/cluster/services/sso/default.nix
index 03b0cef..5171ff9 100644
--- a/cluster/services/sso/default.nix
+++ b/cluster/services/sso/default.nix
@@ -2,8 +2,14 @@
 
 {
   services.sso = {
-    nodes.host = [ "VEGAS" ];
-    nixos.host = ./host.nix;
+    nodes = {
+      host = [ "VEGAS" ];
+      oauth2-proxy = [ "VEGAS" ];
+    };
+    nixos = {
+      host = ./host.nix;
+      oauth2-proxy = ./oauth2-proxy.nix;
+    };
   };
 
   dns.records = let
diff --git a/hosts/VEGAS/modules/oauth2-proxy/default.nix b/cluster/services/sso/oauth2-proxy.nix
similarity index 93%
rename from hosts/VEGAS/modules/oauth2-proxy/default.nix
rename to cluster/services/sso/oauth2-proxy.nix
index faa1e8f..60f006c 100644
--- a/hosts/VEGAS/modules/oauth2-proxy/default.nix
+++ b/cluster/services/sso/oauth2-proxy.nix
@@ -5,7 +5,7 @@ let
 in
 {
   age.secrets.oauth2_proxy-secrets = {
-    file = ../../../../secrets/oauth2_proxy-secrets.age;
+    file = ../../../secrets/oauth2_proxy-secrets.age;
     owner = "root";
     group = "root";
     mode = "0400";
diff --git a/hosts/VEGAS/system.nix b/hosts/VEGAS/system.nix
index 4ee25df..5049acd 100644
--- a/hosts/VEGAS/system.nix
+++ b/hosts/VEGAS/system.nix
@@ -8,7 +8,6 @@
 
       # Plumbing
       ./modules/database
-      ./modules/oauth2-proxy
       ./modules/redis
       ./modules/virtualisation
       depot.inputs.agenix.nixosModules.age