diff --git a/scripts/prepare-host-key.sh b/scripts/prepare-host-key.sh
index 1277f55..51bd6e9 100755
--- a/scripts/prepare-host-key.sh
+++ b/scripts/prepare-host-key.sh
@@ -26,7 +26,7 @@ if [[ ! -f "$sops_yaml" ]]; then
   exit 1
 fi
 
-keydir="$(dirname "$0")/../host-keys"
+keydir="$(cd "$(dirname "$0")/.." && pwd)/host-keys"
 mkdir -p "$keydir"
 keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"
 
@@ -35,16 +35,16 @@ if [[ -f "$keyfile" ]]; then
   exit 1
 fi
 
-nix-shell -p openssh ssh-to-age --run "
-  set -euo pipefail
-  ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}' >/dev/null
-  age_pub=\$(ssh-to-age -i '${keyfile}.pub')
-  cat <<EOF
+nix-shell -p openssh --run "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null
+
+age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")"
+
+cat <<EOF
 
 Generated: ${keyfile}(.pub)
 
-=== 1. Add this line under `keys:` in ${sops_yaml} ===
-  - &${hostname} \${age_pub}
+=== 1. Add this line under keys: in ${sops_yaml} ===
+  - &${hostname} ${age_pub}
 
 === 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
 (e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
@@ -62,4 +62,3 @@ Generated: ${keyfile}(.pub)
 Then continue with /etc/auto-install.sh as normal — it will find the
 pre-seeded key and install it before running nixos-install.
 EOF
-"