anchor.diff:      };
     };
   
  -  allSecretSvcs = flatten (mapAttrsToList (secretName: secret:
  -    mapAttrsToList
  -      (svcName: svc: { inherit secretName secret svcName svc; })
  -      secret.services
  -  ) config.crypto.secrets);
  +  # String -> [{svc,secretName,secret}]
  +  secretsForService = svcName: flatten (mapAttrsToList (secretName: secret:
  +    let svc = findFirst ({name,value}: name == svcName) [] (
  +      mapAttrsToList nameValuePair secret.services
  +    ); in
  +      if svc == [] then []
  +      else { svc = svc.value; inherit secretName secret; }
  +  ) cfg.secrets);
   
  -  dependentServices = genAttrs (unique (map (s: s.svcName) allSecretSvcs)) (svcName: {
  -    restartTriggers = singleton (hashString "sha256" (concatMapStrings (
  -      {secret, svc, ...}: decryptSecretScript secret svc
  -    ) (filter (s: s.svcName == svcName) allSecretSvcs)));
  -  });
  +  svcNames = unique (
  +    concatMap (s: attrNames s.services) (attrValues cfg.secrets)
  +  );
   
  -  decryptServices = mapAttrsToList (secretName: secret: {
  -    "secret-${secretName}" = rec {
  -      wantedBy = map (s: s+".service") (attrNames secret.services);
  +  dependentServices = map (svcName: {
  +    ${svcName} = {
  +      restartTriggers = singleton (hashString "sha256" (
  +        "${decryptSecretsScript svcName}"
  +      ));
  +    };
  +  }) svcNames;
  +
  +  decryptServices = map (svcName: {
  +    "secrets-for-${svcName}" = rec {
  +      wantedBy = [ "${svcName}.service" ];
         before = wantedBy;
  -      script = concatMapStringsSep "\n"
  -                 (svc: decryptSecretScript secret svc)
  -                 (attrValues secret.services);
  +      script = "${decryptSecretsScript svcName}";
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
         };
       };
  -  }) config.crypto.secrets;
  +  }) svcNames;
   
     purgeOldSecrets = singleton {
       purge-old-secrets = {
  
positive.code:       script = ''
          ${findutils}/bin/find /run/secrets -type f | ${gnugrep}/bin/grep -vf ${
            writeText "secret-paths" (
              concatMapStringsSep "\n" (s: s.svc.path) allSecretSvcs
            )
          } | ${findutils}/bin/xargs -r rm -v
        '';
  
negative.code: 
    config = mkIf (config.crypto.secrets != {}) {
      systemd.services = mkMerge (
        dependentServices ++ decryptServices ++ purgeOldSecrets
      );
    };
  
  