diff --git a/terranix/containers/hydra/default.nix b/terranix/containers/hydra/default.nix
index 294ae75..7752e14 100644
--- a/terranix/containers/hydra/default.nix
+++ b/terranix/containers/hydra/default.nix
@@ -32,7 +32,7 @@ in
   resource."vault_policy"."hydra-policy" = {
     name = "hydra-policy";
     policy = ''
-      path "kv/data/hydra" {
+      path "kv/data/cluster/hydra" {
         capabilities = ["read"]
       }
     '';
diff --git a/terranix/containers/hydra/job.hcl b/terranix/containers/hydra/job.hcl
index 9a960b3..a92e750 100644
--- a/terranix/containers/hydra/job.hcl
+++ b/terranix/containers/hydra/job.hcl
@@ -122,7 +122,7 @@ job "hydra" {
 
       template {
         data = <<EOF
-{{ with secret "kv/data/hydra" }}{{ .Data.data.nixbuild_key }}{{ end }}
+{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.nixbuild_key }}{{ end }}
 EOF
         destination = "secrets/ssh-key"
         perms = "400"
@@ -137,7 +137,7 @@ EOF
 
       template {
         data = <<EOF
-127.0.0.1:*:*:hydra:{{ with secret "kv/data/hydra" }}{{ .Data.data.pgpass}}{{ end }}
+127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
 EOF
         destination = "secrets/pgpass"
         perms = "400"
@@ -145,7 +145,7 @@ EOF
 
       template {
         data = <<EOF
-127.0.0.1:*:*:hydra:{{ with secret "kv/data/hydra" }}{{ .Data.data.pgpass}}{{ end }}
+127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
 EOF
         destination = "secrets/pgpass-www"
         perms = "400"
@@ -153,7 +153,7 @@ EOF
 
       template {
         data = <<EOF
-127.0.0.1:*:*:hydra:{{ with secret "kv/data/hydra" }}{{ .Data.data.pgpass}}{{ end }}
+127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
 EOF
         destination = "secrets/pgpass-queue-runner"
         perms = "400"
@@ -184,7 +184,7 @@ EOF
 
       template {
         data = <<EOF
-alter user hydra with encrypted password '{{ with secret "kv/data/hydra" }}{{ .Data.data.pgpass}}{{ end }}';
+alter user hydra with encrypted password '{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}';
 EOF
         destination = "secrets/init.sql"
       }