diff --git a/modules/nixos/clicks/security/secrets/default.nix b/modules/nixos/clicks/security/secrets/default.nix
index 332efbe..8a120f9 100644
--- a/modules/nixos/clicks/security/secrets/default.nix
+++ b/modules/nixos/clicks/security/secrets/default.nix
@@ -12,8 +12,10 @@
     default = config.clicks.defaults.enable;
   };
 
-  config = lib.mkIf cfg.enable {
-    age.rekey = {
+  options.age = {}; # Required definition for lib.optionalAttrs...
+
+  config.age = lib.optionalAttrs cfg.enable {
+    rekey = {
       masterIdentities = [
         "${inputs.self}/secrets/keys/minion/collabora-yubikey.pub"
         "${inputs.self}/secrets/keys/minion/tiny-yubikey.pub"
@@ -24,7 +26,7 @@
       localStorageDir = lib.snowfall.fs.get-snowfall-file "secrets/rekeyed/${config.networking.hostName}";
     };
 
-    age.identityPaths = lib.mkIf config.clicks.storage.impermanence.enable [
+    identityPaths = lib.mkIf config.clicks.storage.impermanence.enable [
       "/persist/data/etc/ssh/ssh_host_ed25519_key"
       "/persist/data/etc/ssh/ssh_host_rsa_key"
     ];
diff --git a/modules/nixos/clicks/security/secrets/groupPerms/default.nix b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
index 1f176ac..8337643 100644
--- a/modules/nixos/clicks/security/secrets/groupPerms/default.nix
+++ b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
@@ -15,11 +15,8 @@
   options.age = {
     secrets = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule (submodule: {
-        config = {
-          mode = lib.pipe "0440" [
-            (lib.mkOverride 999)
-            (lib.mkIf config.clicks.security.secrets.groupPerms.enable)
-          ];
+        config = lib.optionalAttrs config.clicks.security.secrets.groupPerms.enable {
+          mode = lib.mkOverride 999 "0440";
         };
       }));
     };
diff --git a/modules/nixos/clicks/security/secrets/instability/default.nix b/modules/nixos/clicks/security/secrets/instability/default.nix
index f1362a4..e276c13 100644
--- a/modules/nixos/clicks/security/secrets/instability/default.nix
+++ b/modules/nixos/clicks/security/secrets/instability/default.nix
@@ -20,6 +20,9 @@
     secrets = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule (submodule: {
         options = {
+          name = lib.mkOption {
+            type = lib.types.str;
+          };
           unstableName = lib.mkOption {
             type = lib.types.bool;
             default = config.clicks.security.secrets.instability.enable;
@@ -38,12 +41,12 @@
             '';
           };
         };
-        config = {
+        config = lib.mkIf submodule.config.unstableName {
           # Calculate the name as the sha256 hash of the rekeyFile or file... whichever happens to exist for this secret
           name = let
             dependency = submodule.config.rekeyFile or submodule.config.file;
             hash = builtins.hashFile "sha256" dependency;
-          in lib.mkIf submodule.config.unstableName hash;
+          in hash;
         };
       }));
     };