diff --git a/profiles/base/shell/nushell.nix b/profiles/base/shell/nushell.nix
index 469fab1..61e2ebc 100644
--- a/profiles/base/shell/nushell.nix
+++ b/profiles/base/shell/nushell.nix
@@ -44,9 +44,13 @@ in {
 
           # Load m3tam3re secrets from agenix. The secret file is Nushell code
           # containing a `load-env { ... }` block, not KEY=VALUE lines.
-          if ("/run/agenix/m3tam3re-secrets" | path exists) {
-            source /run/agenix/m3tam3re-secrets
+          # `source` resolves literal paths at parse time, so use `null` when absent.
+          const m3tam3re_secrets_file = if ("/run/agenix/m3tam3re-secrets" | path exists) {
+            "/run/agenix/m3tam3re-secrets"
+          } else {
+            null
           }
+          source $m3tam3re_secrets_file
       '';
 
       configFile.text = ''