anchor.diff:          '';
         };
   
  -      openssh =
  -        { privateKeyPath = mkOption {
  -            type = types.path;
  -            description = ''
  -              Private agent key.
  -
  -              A run-time path to the key file, which is supposed to be provisioned
  -              outside of Nix store.
  -            '';
  -          };
  -          publicKeyPath = mkOption {
  -            type = types.path;
  -            description = ''
  -              Public agent key.
  -
  -              A run-time path to the key file, which is supposed to be provisioned
  -              outside of Nix store.
  -            '';
  -          };
  -        };
  +      privateSshKeyPath = mkOption {
  +        type = types.path;
  +        ## maximum care is taken so that secrets (ssh keys and the CI token)
  +        ## don't end up in the Nix store.
  +        apply = final: if final == null then null else toString final;
  +
  +        description = ''
  +          OpenSSH private key
  +
  +          A run-time path to the key file, which is supposed to be provisioned
  +          outside of Nix store.
  +        '';
  +      };
   
         hooks = mkHookOptions [
           { name = "checkout";
  
positive.code:     ];
    };
    imports = [
      (mkRenamedOptionModule [ "services" "buildkite-agent" "token" ]                [ "services" "buildkite-agent" "tokenPath" ])
      (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "privateKey" ] [ "services" "buildkite-agent" "openssh" "privateKeyPath" ])
      (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "publicKey" ]  [ "services" "buildkite-agent" "openssh" "publicKeyPath" ])
    ];
  }
  
negative.code:           ''
              mkdir -m 0700 -p "${sshDir}"
              cp -f "${toString cfg.openssh.privateKeyPath}" "${sshDir}/id_rsa"
              chmod 600 "${sshDir}"/id_rsa*
  
              cat > "${cfg.dataDir}/buildkite-agent.cfg" <<EOF
  