diff --git a/hosts/lab/shlink.nix b/hosts/lab/shlink.nix
index 82b38c6..5d880d2 100644
--- a/hosts/lab/shlink.nix
+++ b/hosts/lab/shlink.nix
@@ -31,15 +31,8 @@
   };
 
   systemd.services.postgresql.postStart = lib.mkAfter ''
-    $PSQL -tA <<'EOF'
-      DO $$
-      DECLARE pw TEXT;
-      BEGIN
-        pw := trim(both from pg_read_file('${config.sops.secrets.shlink-db-password.path}'));
-        EXECUTE format('ALTER USER shlink PASSWORD %L', pw);
-      END
-      $$;
-    EOF
+    ${config.services.postgresql.package}/bin/psql -tAc \
+      "ALTER ROLE shlink PASSWORD '$(tr -d '\n' < ${config.sops.secrets.shlink-db-password.path})';"
   '';
 
   services.caddy.virtualHosts."ily.rs" = {