diff --git a/system/pull-update.nix b/system/pull-update.nix
index 3c3e100..07c53fa 100644
--- a/system/pull-update.nix
+++ b/system/pull-update.nix
@@ -3,7 +3,7 @@
 # records the output store path at /deploy/<hostname>.  On boot this
 # service fetches that path, pulls the closure from the binary cache,
 # sets it as the boot profile, and reboots into it.
-{ pkgs, hostname, ... }:
+{ pkgs, hostname, lib, ... }:
 let
   deploy-url = "https://nix-cache.sigkill.computer/deploy/${hostname}";
 
@@ -64,7 +64,7 @@ in
     restartIfChanged = false;
     serviceConfig = {
       Type = "oneshot";
-      ExecStart = pull-update;
+      ExecStart = lib.getExe pull-update;
     };
   };
 }