diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index d7ed2acf7664..746d3c0b3839 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -55,10 +55,13 @@ in
         '';
       };
       intermediatePasswordFile = lib.mkOption {
-        type = lib.types.pathWith {
-          inStore = false;
-          absolute = true;
-        };
+        type = lib.types.nullOr (
+          lib.types.pathWith {
+            inStore = false;
+            absolute = true;
+          }
+        );
+        default = null;
         example = "/run/keys/smallstep-password";
         description = ''
           Path to the file containing the password for the intermediate
@@ -104,11 +107,18 @@ in
           ReadWritePaths = ""; # override upstream
 
           # LocalCredential handles file permission problems arising from the use of DynamicUser.
-          LoadCredential = "intermediate_password:${cfg.intermediatePasswordFile}";
+          LoadCredential = lib.mkIf (
+            cfg.intermediatePasswordFile != null
+          ) "intermediate_password:${cfg.intermediatePasswordFile}";
 
           ExecStart = [
             "" # override upstream
-            "${cfg.package}/bin/step-ca /etc/smallstep/ca.json --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+            (
+              "${cfg.package}/bin/step-ca /etc/smallstep/ca.json"
+              + lib.optionalString (
+                cfg.intermediatePasswordFile != null
+              ) " --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+            )
           ];
 
           # ProtectProc = "invisible"; # not supported by upstream yet