diff --git a/nixos/modules/security/acme/mk-cert-ownership-assertion.nix b/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
index 53a3fbaadd2e..0339d7920ad9 100644
--- a/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
+++ b/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
@@ -6,7 +6,7 @@ let
 
   svcGroups = svc:
     (lib.optional (svc.serviceConfig ? Group) svc.serviceConfig.Group)
-    ++ (svc.serviceConfig.SupplementaryGroups or [ ]);
+    ++ lib.toList (svc.serviceConfig.SupplementaryGroups or [ ]);
 in
 {
   assertion = builtins.all (svc: