diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 13012e176753..1f09716c6322 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -826,8 +826,8 @@ let
           type = lib.types.attrsOf (lib.types.path);
           inherit (defaultAndText "credentialFiles" { }) default defaultText;
           description = ''
-            Environment variables suffixed by "_FILE" to set for the cert's service
-            for your selected dnsProvider.
+            Environment variables suffixed by "_FILE" or "_PATH" to set for the
+            cert's service for your selected dnsProvider.
             To find out what values you need to set, consult the documentation at
             <https://go-acme.github.io/lego/dns/> for the corresponding dnsProvider.
             This allows to securely pass credential files to lego by leveraging systemd
@@ -1186,10 +1186,13 @@ in
               }
             )
             {
-              assertion = lib.all (lib.hasSuffix "_FILE") (lib.attrNames data.credentialFiles);
+              assertion = lib.all (n: lib.hasSuffix "_FILE" n || lib.hasSuffix "_PATH" n) (
+                lib.attrNames data.credentialFiles
+              );
+
               message = ''
                 Option `security.acme.certs.${cert}.credentialFiles` can only be
-                used for variables suffixed by "_FILE".
+                used for variables suffixed by "_FILE" or "_PATH".
               '';
             }