diff --git a/nixos/modules/services/web-servers/pomerium.nix b/nixos/modules/services/web-servers/pomerium.nix
--- a/nixos/modules/services/web-servers/pomerium.nix
+++ b/nixos/modules/services/web-servers/pomerium.nix
@@ -119,7 +119,7 @@ in
       before = [ "acme-finished-${cfg.useACMEHost}.target" ];
       after = [ "acme-${cfg.useACMEHost}.service" ];
       # Block reloading if not all certs exist yet.
-      unitConfig.ConditionPathExists = [ "${certs.${cfg.useACMEHost}.directory}/fullchain.pem" ];
+      unitConfig.ConditionPathExists = [ "${config.security.acme.certs.${cfg.useACMEHost}.directory}/fullchain.pem" ];
       serviceConfig = {
         Type = "oneshot";
         TimeoutSec = 60;