diff --git a/profiles/workspace/aws.nix b/profiles/workspace/aws.nix
index ca69903..005ff86 100644
--- a/profiles/workspace/aws.nix
+++ b/profiles/workspace/aws.nix
@@ -4,6 +4,8 @@
     services = [ ];
   };
 
+  systemd.tmpfiles.rules = [ "L+ /root/.aws/credentials - - - - ${config.secrets.aws_credentials.decrypted}" ];
+
   environment.sessionVariables = {
     AWS_SHARED_CREDENTIALS_FILE = config.secrets.aws_credentials.decrypted;
     AWS_CONFIG_FILE = toString (pkgs.writeText "aws_config"