diff --git a/flake.nix b/flake.nix
index 9e185a4..0ace9c4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -531,7 +531,7 @@
                     ) // (
                       if (cfg.replication.enable && cfg.replication.role == "replica")
                       then {
-                        PGPASSFILE = "${dataDir}/.pgpass";
+                        PGPASSFILE = "${rootDir}/.pgpass";
                       }
                       else { }
                     );
@@ -564,8 +564,8 @@
                       else
                         ''
                           read -r password < ${cfg.replication.passwordFile}
-                          (umask 077; echo "${cfg.replication.primary.hostname}:${builtins.toString cfg.replication.primary.port}:replication:${cfg.replication.username}:''${password}" > ${dataDir}/.pgpass)
-                          chmod 0600 ${dataDir}/.pgpass
+                          (umask 077; echo "${cfg.replication.primary.hostname}:${builtins.toString cfg.replication.primary.port}:replication:${cfg.replication.username}:''${password}" > ${rootDir}/.pgpass)
+                          chmod 0600 ${rootDir}/.pgpass
 
                           if [ ! -s "${dataDir}/PG_VERSION" ]
                           then