diff --git a/lib/xlib/dirs.nix b/lib/xlib/dirs.nix
index a2fd046..a3537a6 100644
--- a/lib/xlib/dirs.nix
+++ b/lib/xlib/dirs.nix
@@ -14,6 +14,7 @@ in
     server-home
     services-mnt-folder
     ;
+  opencode-server-env = "${user-home}/.config/opencode/server.env";
 
   user-storage = "${user-home}/Storage";
   wsl-storage = "${wsl-home}/Storage";
diff --git a/modules/users.nix b/modules/users.nix
index 2c9b8f4..d14acc6 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -111,8 +111,11 @@ in
       # Decrypted as a single dotenv file (no `key`) and consumed by the
       # systemd user unit opencode-web as EnvironmentFile.
       # Source: secrets/opencode.env (encrypted, see sops/age below).
+      # Path is shared with home/modules/opencode.nix via xlib.dirs so the
+      # sops materialization and the systemd EnvironmentFile can never
+      # silently desync.
       opencode_server = mkUserSecret {
-        path = "${xlib.dirs.user-home}/.config/opencode/server.env";
+        path = xlib.dirs.opencode-server-env;
         mode = "0600";
         format = "dotenv";
         sopsFile = ../secrets/opencode.env;