diff --git a/.envrc b/.envrc
index c338a93bb..34fe568ce 100644
--- a/.envrc
+++ b/.envrc
@@ -4,4 +4,3 @@
 export PATH="${PWD}/bin:${PATH}"
 export NIX_PATH="nixpkgs=${PWD}/default.nix"
 export REPO_ROOT="${PWD}"
-export SECRETS_DIR="${PWD}/ops/secrets"
diff --git a/ops/kms_pass.nix b/ops/kms_pass.nix
index 14989b392..b8a97d133 100644
--- a/ops/kms_pass.nix
+++ b/ops/kms_pass.nix
@@ -14,6 +14,7 @@ in (writeShellScriptBin "pass" ''
 
   CMD="$1"
   readonly SECRET=$2
+  readonly SECRETS_DIR=${./secrets}
   readonly SECRET_PATH="$SECRETS_DIR/$SECRET"
 
   function secret_check {