diff --git a/mail-server/postfix.nix b/mail-server/postfix.nix
index 84de67e..8a8e336 100644
--- a/mail-server/postfix.nix
+++ b/mail-server/postfix.nix
@@ -392,7 +392,7 @@ in
           let
             mkGroupString = groups: concatStringsSep " / " (map (concatStringsSep ":") groups);
           in
-          "${iniFormat.generate "postfix-openssl.cnf" {
+          iniFormat.generate "postfix-openssl.cnf" {
             globalSection.postfix = "postfix_settings";
             sections = {
               postfix_settings.ssl_conf = "postfix_ssl_settings";
@@ -406,7 +406,7 @@ in
                 ]
               ];
             };
-          }}";
+          };
         tls_config_name = "postfix";
 
         # Algorithm selection happens through `tls_config_file` instead.