diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index e430c2ddb903..9e5d636241e9 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -257,7 +257,7 @@ in
 
                     if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then
                       ${if data.activationDelay != null then ''
-                      
+
                       ${data.preDelay}
 
                       if [ -d '${lpath}' ]; then
@@ -266,6 +266,10 @@ in
                         systemctl --wait start acme-setlive-${cert}.service
                       fi
                       '' else data.postRun}
+
+                      # noop ensuring that the "if" block is non-empty even if
+                      # activationDelay == null and postRun == ""
+                      true
                     fi
                   '';
 
@@ -294,7 +298,7 @@ in
                         chown '${data.user}:${data.group}' '${cpath}'
                       fi
                   '';
-                  script = 
+                  script =
                     ''
                       workdir="$(mktemp -d)"