diff --git a/hosts/plover/modules/services/vaultwarden.nix b/hosts/plover/modules/services/vaultwarden.nix
index 7473198a..3a06b6f5 100644
--- a/hosts/plover/modules/services/vaultwarden.nix
+++ b/hosts/plover/modules/services/vaultwarden.nix
@@ -108,7 +108,7 @@ in
       # Restricting what capabilities it has access to which it
       # has none.
       CapabilityBoundingSet = [ "" ];
-      AmbientCapability = [ "" ];
+      AmbientCapabilities = lib.mkForce [ "" ];
 
       # Restrict what address families this service can interact
       # with. Since it is a web service, we expect it will only