diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index 6b90c1acb688..ae3525d3315a 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -5,8 +5,6 @@
   lib,
   nixosTests,
   ghostunnel,
-  writeScript,
-  runtimeShell,
 }:
 
 buildGoModule rec {
@@ -37,9 +35,7 @@ buildGoModule rec {
 
   passthru.services.default = {
     imports = [
-      (lib.modules.importApply ./service.nix {
-        inherit writeScript runtimeShell;
-      })
+      (lib.modules.importApply ./service.nix { })
     ];
     ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
   };
diff --git a/pkgs/by-name/gh/ghostunnel/service.nix b/pkgs/by-name/gh/ghostunnel/service.nix
index 4fb7db2c3150..52a2f4016e79 100644
--- a/pkgs/by-name/gh/ghostunnel/service.nix
+++ b/pkgs/by-name/gh/ghostunnel/service.nix
@@ -1,5 +1,5 @@
 # Non-module dependencies (`importApply`)
-{ writeScript, runtimeShell }:
+{ }:
 
 # Service module
 {
@@ -185,62 +185,56 @@ in
     # TODO assertions
 
     process = {
-      argv =
-        # Use a shell if credentials need to be pulled from the environment.
-        optional
-          (builtins.any (v: v != null) [
-            cfg.keystore
-            cfg.cert
-            cfg.key
-            cfg.cacert
-          ])
-          (
-            writeScript "load-credentials" ''
-              #!${runtimeShell}
-              exec $@ ${
-                concatStringsSep " " (
-                  optional (cfg.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
-                  ++ optional (cfg.cert != null) "--cert=$CREDENTIALS_DIRECTORY/cert"
-                  ++ optional (cfg.key != null) "--key=$CREDENTIALS_DIRECTORY/key"
-                  ++ optional (cfg.cacert != null) "--cacert=$CREDENTIALS_DIRECTORY/cacert"
-                )
-              }
-            ''
-          )
-        ++ [
-          (getExe cfg.package)
-          "server"
-          "--listen"
-          cfg.listen
-          "--target"
-          cfg.target
-        ]
-        ++ optional cfg.allowAll "--allow-all"
-        ++ map (v: "--allow-cn=${v}") cfg.allowCN
-        ++ map (v: "--allow-ou=${v}") cfg.allowOU
-        ++ map (v: "--allow-dns=${v}") cfg.allowDNS
-        ++ map (v: "--allow-uri=${v}") cfg.allowURI
-        ++ optional cfg.disableAuthentication "--disable-authentication"
-        ++ optional cfg.unsafeTarget "--unsafe-target"
-        ++ cfg.extraArguments;
+      argv = [
+        (getExe cfg.package)
+        "server"
+        "--listen"
+        cfg.listen
+        "--target"
+        cfg.target
+      ]
+      ++ optional cfg.allowAll "--allow-all"
+      ++ map (v: "--allow-cn=${v}") cfg.allowCN
+      ++ map (v: "--allow-ou=${v}") cfg.allowOU
+      ++ map (v: "--allow-dns=${v}") cfg.allowDNS
+      ++ map (v: "--allow-uri=${v}") cfg.allowURI
+      ++ optional cfg.disableAuthentication "--disable-authentication"
+      ++ optional cfg.unsafeTarget "--unsafe-target"
+      ++ cfg.extraArguments;
     };
   }
-  // lib.optionalAttrs (options ? systemd) {
-    # refine the service
-    systemd.service = {
-      after = [ "network.target" ];
-      wants = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Restart = "always";
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        DynamicUser = true;
-        LoadCredential =
-          optional (cfg.keystore != null) "keystore:${cfg.keystore}"
-          ++ optional (cfg.cert != null) "cert:${cfg.cert}"
-          ++ optional (cfg.key != null) "key:${cfg.key}"
-          ++ optional (cfg.cacert != null) "cacert:${cfg.cacert}";
+  # Refine the service for systemd
+  // lib.optionalAttrs (options ? systemd) (
+    let
+      # Build credential flags with systemd variable substitution
+      credentialFlags = concatStringsSep " " (
+        optional (cfg.keystore != null) "--keystore=\${CREDENTIALS_DIRECTORY}/keystore"
+        ++ optional (cfg.cert != null) "--cert=\${CREDENTIALS_DIRECTORY}/cert"
+        ++ optional (cfg.key != null) "--key=\${CREDENTIALS_DIRECTORY}/key"
+        ++ optional (cfg.cacert != null) "--cacert=\${CREDENTIALS_DIRECTORY}/cacert"
+      );
+    in
+    {
+      # Use mainExecStart to add credential flags with systemd variable substitution
+      systemd.mainExecStart =
+        config.systemd.lib.escapeSystemdExecArgs config.process.argv
+        + lib.optionalString (credentialFlags != "") " ${credentialFlags}";
+
+      systemd.service = {
+        after = [ "network.target" ];
+        wants = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Restart = "always";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          DynamicUser = true;
+          LoadCredential =
+            optional (cfg.keystore != null) "keystore:${cfg.keystore}"
+            ++ optional (cfg.cert != null) "cert:${cfg.cert}"
+            ++ optional (cfg.key != null) "key:${cfg.key}"
+            ++ optional (cfg.cacert != null) "cacert:${cfg.cacert}";
+        };
       };
-    };
-  };
+    }
+  );
 }