diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 13012e176753..7bce714b2a0b 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -2,13 +2,11 @@
   config,
   lib,
   pkgs,
-  options,
   ...
 }:
 let
 
   cfg = config.security.acme;
-  opt = options.security.acme;
   user = if cfg.useRoot then "root" else "acme";
 
   # Used to calculate timer accuracy for coalescing
@@ -826,8 +824,8 @@ let
           type = lib.types.attrsOf (lib.types.path);
           inherit (defaultAndText "credentialFiles" { }) default defaultText;
           description = ''
-            Environment variables suffixed by "_FILE" to set for the cert's service
-            for your selected dnsProvider.
+            Environment variables suffixed by "_FILE" or "_PATH" to set for the
+            cert's service for your selected dnsProvider.
             To find out what values you need to set, consult the documentation at
             <https://go-acme.github.io/lego/dns/> for the corresponding dnsProvider.
             This allows to securely pass credential files to lego by leveraging systemd
@@ -1186,10 +1184,13 @@ in
               }
             )
             {
-              assertion = lib.all (lib.hasSuffix "_FILE") (lib.attrNames data.credentialFiles);
+              assertion = lib.all (n: lib.hasSuffix "_FILE" n || lib.hasSuffix "_PATH" n) (
+                lib.attrNames data.credentialFiles
+              );
+
               message = ''
                 Option `security.acme.certs.${cert}.credentialFiles` can only be
-                used for variables suffixed by "_FILE".
+                used for variables suffixed by "_FILE" or "_PATH".
               '';
             }