diff --git a/lib/default.nix b/lib/default.nix
index d24b4ce..f523c1a 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -80,13 +80,6 @@ let
 
         generatedReplacements = map genReplacement replacements;
 
-        replaceCommands = concatMapStringsSep "\n" (pattern: ''
-          ${replaceScript} \
-            --file ${escapeShellArg resultPath} \
-            --marker ${escapeShellArg pattern.name} \
-            --replacement "${pattern.value}"
-        '') generatedReplacements;
-
         replaceScript = pkgs.writers.writePython3 "replace-secret" { } ''
           import argparse
           import pathlib
@@ -105,6 +98,13 @@ let
           args.file.write_text(content.replace(args.marker, args.replacement))
         '';
 
+        replaceCommands = concatMapStringsSep "\n" (pattern: ''
+          ${replaceScript} \
+            --file ${escapeShellArg resultPath} \
+            --marker ${escapeShellArg pattern.name} \
+            --replacement "${pattern.value}"
+        '') generatedReplacements;
+
         replaceCmd =
           if replacements == [ ] then
             "cat ${escapeShellArg templatePath} > ${escapeShellArg resultPath}"