diff --git a/deploy/nixos/configuration.nix b/deploy/nixos/configuration.nix
index f016179..20e5742 100644
--- a/deploy/nixos/configuration.nix
+++ b/deploy/nixos/configuration.nix
@@ -488,8 +488,12 @@ in
   system.activationScripts.bitspire-env-migration = {
     deps = [ "users" ];
     text = ''
-      if [ -f /var/lib/bitspire/.env ] && grep -q '^VITE_LAMASSU_' /var/lib/bitspire/.env; then
-        sed -i 's/^VITE_LAMASSU_/VITE_BITSPIRE_/' /var/lib/bitspire/.env
+      # Activation scripts run with a minimal PATH (coreutils, not gnugrep /
+      # gnused) — the first run of this snippet died with "sed: command not
+      # found" after printing success, so reference both by store path.
+      if [ -f /var/lib/bitspire/.env ] \
+         && ${pkgs.gnugrep}/bin/grep -q '^VITE_LAMASSU_' /var/lib/bitspire/.env; then
+        ${pkgs.gnused}/bin/sed -i 's/^VITE_LAMASSU_/VITE_BITSPIRE_/' /var/lib/bitspire/.env
         echo "bitspire: migrated VITE_LAMASSU_* keys in /var/lib/bitspire/.env"
       fi
     '';