We need to switch to a systemd service running before nextcloud-setup because the secret file is now loaded with LoadCredential, which means it must exist before the systemd service starts