diff --git a/global/fs/zfs/split.nix b/global/fs/zfs/split.nix
index f49c2c09..22f9231f 100644
--- a/global/fs/zfs/split.nix
+++ b/global/fs/zfs/split.nix
@@ -31,5 +31,5 @@ in mkIf cfg.enable {
   };
 
   # import system state pool after encrypted filesystems become available for key loading
-  boot.initrd.systemd.services."zfs-import-${config.global.fs.store}".after = [ "cryptsetup.target" ];
+  boot.initrd.systemd.services."zfs-import-${config.global.fs.store}".after = [ "sysroot-nix-var-secret.mount" "cryptsetup.target" ];
 }