diff --git a/nix/modules/nixos/infrastructure/vault-server-approle/unix-user.nix b/nix/modules/nixos/infrastructure/vault-server-approle/unix-user.nix
index 7ab1b39..e713edb 100644
--- a/nix/modules/nixos/infrastructure/vault-server-approle/unix-user.nix
+++ b/nix/modules/nixos/infrastructure/vault-server-approle/unix-user.nix
@@ -6,7 +6,7 @@
 }:
 let
   cfg = config.khscodes.infrastructure.vault-server-approle.enable;
-  userExists = username: builtins.hasAttr username config.users.users && config.users.users.enable;
+  userExists = username: (builtins.hasAttr username config.users.users) && config.users.users.enable;
   setKhsPassword = pkgs.writeShellApplication {
     name = "set-khs-password";
     runtimeInputs = [