diff --git a/nixos/modules/services/system/kerberos/heimdal.nix b/nixos/modules/services/system/kerberos/heimdal.nix
index 4c1df2088ae3..0965c6c5385a 100644
--- a/nixos/modules/services/system/kerberos/heimdal.nix
+++ b/nixos/modules/services/system/kerberos/heimdal.nix
@@ -21,7 +21,10 @@ let
           target,
           ...
         }:
-        "${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
+        if target != "*" && target != "" then
+          "${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
+        else
+          "${principal}\t${lib.concatStringsSep "," (lib.toList access)}"
       ) acl
     ))
     (lib.mapAttrsToList (