diff --git a/hosts/modules/roles/client/wifi-pairings.nix b/hosts/modules/roles/client/wifi-pairings.nix
index 0b0f4780..8b01bb7c 100644
--- a/hosts/modules/roles/client/wifi-pairings.nix
+++ b/hosts/modules/roles/client/wifi-pairings.nix
@@ -9,7 +9,7 @@
       generated.script.script = builtins.readFile ../../../../scripts/install-iwd + ''
         touch "/var/lib/iwd/.secrets.psk.stamp"
       '';
-      generated.script.scriptArgs = [ "/run/secrets/iwd" "/var/lib/iwd" ];
+      generated.script.scriptArgs = [ "/run/secrets/net" "/var/lib/iwd" ];
     };
   };
 }
diff --git a/scripts/install-iwd b/scripts/install-iwd
index 2958da1a..d9091f7a 100755
--- a/scripts/install-iwd
+++ b/scripts/install-iwd
@@ -1,5 +1,5 @@
 #!/bin/sh
-# usage: install-iwd.sh <source_dir> <dest_dir>
+# usage: install-iwd <source_dir> <dest_dir>
 # source_dir contains plain-text .psk files of any filename.
 # for each file, this extracts the SSID and creates a symlink in dest_dir which
 # points to the original file, using the SSID name as filename.
@@ -11,10 +11,12 @@ src_dir="$1"
 dest_dir="$2"
 for f in $(ls "$src_dir")
 do
-        ssid=$(sed -rn 's/# SSID=(.*)/\1/p' "$src_dir/$f")
-        # not sure that iwd can deal with un-writeable symlinks
-        # ln -sf "$src_dir/$f" "$dest_dir/$ssid.psk"
-        cp "$src_dir/$f" "$dest_dir/$ssid.psk"
-        # not strictly necessary, but iwd does default to rw
-        chmod 600 "$dest_dir/$ssid.psk"
+        if [ -f "$src_dir/$f" ]; then
+                ssid=$(sed -rn 's/# SSID=(.*)/\1/p' "$src_dir/$f")
+                # not sure that iwd can deal with un-writeable symlinks
+                # ln -sf "$src_dir/$f" "$dest_dir/$ssid.psk"
+                cp "$src_dir/$f" "$dest_dir/$ssid.psk"
+                # not strictly necessary, but iwd does default to rw
+                chmod 600 "$dest_dir/$ssid.psk"
+        fi
 done