diff --git a/modules/fs/default.nix b/modules/fs/default.nix
index 978283e1..8d2881f7 100644
--- a/modules/fs/default.nix
+++ b/modules/fs/default.nix
@@ -183,13 +183,19 @@ let
   mkGeneratedConfig = path: opt: let
     gen-opt = opt.generated;
     wrapper = generateWrapperScript path gen-opt;
+    ty =
+      if (opt.dir != null) then "dir"
+      else if (opt.symlink != null) then "symlink"
+      else "custom";
+    wrapperPath = pkgs.writeShellScript "sane-fs-ensure-${ty}" wrapper.script;
   in {
     systemd.services."${serviceNameFor path}" = {
       description = "prepare ${path}";
       serviceConfig.Type = "oneshot";
 
-      script = wrapper.script;
-      scriptArgs = escapeShellArgs wrapper.scriptArgs;
+      serviceConfig.ExecStart = escapeShellArgs (
+        [ "${wrapperPath}" ] ++ wrapper.scriptArgs
+      );
 
       after = gen-opt.depends;
       wants = gen-opt.depends;
@@ -242,6 +248,8 @@ let
 
   generateWrapperScript = path: gen-opt: {
     script = ''
+      set -e
+
       fspath="$1"
       acluser="$2"
       aclgroup="$3"