diff --git a/hosts/nixos/home.nix b/hosts/nixos/home.nix
index 64b8b7f..65702e6 100644
--- a/hosts/nixos/home.nix
+++ b/hosts/nixos/home.nix
@@ -27,7 +27,7 @@
     # Optional: set environment vars
     sessionVariables = {
       EDITOR = "vim";
-      SOPS_AGE_KEY_FILE = "~/.config/sops/age/keys.txt";
+      SOPS_AGE_KEY_FILE = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
     };
 
     file = {
diff --git a/scripts/secrets/sync-host-keys.sh b/scripts/secrets/sync-host-keys.sh
index 512929e..3a57373 100755
--- a/scripts/secrets/sync-host-keys.sh
+++ b/scripts/secrets/sync-host-keys.sh
@@ -85,6 +85,10 @@ ensure_admin_decrypt_key() {
   fi
 
   local key_file="$DEFAULT_SOPS_AGE_KEY_FILE"
+  # Expand a leading ~ that survived variable substitution without tilde
+  # expansion (happens when SOPS_AGE_KEY_FILE or XDG_CONFIG_HOME is set with
+  # a literal ~ in the caller's environment).
+  key_file="${key_file/#~\//$HOME/}"
 
   if [[ -s "$key_file" ]]; then
     echo "Found existing sops age key at ${key_file}."
@@ -93,36 +97,23 @@ ensure_admin_decrypt_key() {
 
   if [[ "$dry_run" -eq 1 ]]; then
     echo "[dry-run] No sops age decryption key found (checked \$SOPS_AGE_KEY, \$SOPS_AGE_KEY_FILE, ${key_file})."
-    echo "[dry-run] Would generate a new one here -- continuing the dry run without one; any"
-    echo "[dry-run] 'would re-encrypt' output below couldn't actually run for real yet."
+    echo "[dry-run] Continuing dry run without one -- any 'would re-encrypt' output below"
+    echo "[dry-run] couldn't actually run for real until a key is present."
     return
   fi
 
-  echo "No sops age decryption key found (checked \$SOPS_AGE_KEY, \$SOPS_AGE_KEY_FILE, ${key_file})."
-  echo "Generating a new one at ${key_file}..."
-  mkdir -p "$(dirname "$key_file")"
-  nix-shell "${NIX_OPTS[@]}" -p age --run "age-keygen -o '${key_file}'" 2>&1 | grep -v "^Public key:" || true
-  local new_pub
-  new_pub="$(age_pubkey_from_identity_file "$key_file")"
+  cat >&2 <<EOF
+No sops age decryption key found (checked \$SOPS_AGE_KEY, \$SOPS_AGE_KEY_FILE, ${key_file}).
 
-  cat <<EOF
+Place your admin age private key at ${key_file}, or set SOPS_AGE_KEY (inline
+key) or SOPS_AGE_KEY_FILE (path to a different key file) and re-run.
 
-A brand-new age key was just generated -- it cannot decrypt anything that
-already exists in secrets/*.yaml, since nothing was ever encrypted for it.
-That trust can't be bootstrapped automatically (nobody can decrypt a file
-for a recipient that didn't exist when it was last encrypted).
-
-To actually use this key:
-  1. Have someone who currently CAN decrypt replace the &admin entry in
-     .sops.yaml with this public key:
-       ${new_pub}
-  2. They re-encrypt every secrets/*.yaml:
-       sops updatekeys --yes secrets/common.yaml
-       sops updatekeys --yes secrets/nix-cache.yaml
-       sops updatekeys --yes secrets/server.yaml
-  3. Re-run this script.
-
-Exiting without making any other changes.
+If the key is truly missing (not just mislocated), this is a manual recovery
+situation -- generating a brand-new admin key won't help, since it cannot
+decrypt anything already encrypted for the old one.  Each secrets/*.yaml is
+also encrypted for its respective host key(s), so a running deployed host can
+still decrypt what it needs -- but the admin key is required for re-encryption
+(e.g. adding new recipients via sops updatekeys).
 EOF
   exit 1
 }