diff --git a/user-data.sh.tftpl b/user-data.sh.tftpl
index 0f9cd00..7f6a7dc 100644
--- a/user-data.sh.tftpl
+++ b/user-data.sh.tftpl
@@ -120,7 +120,7 @@ write_final_config() {
             wantedBy = [ "multi-user.target" ];
             after = [ "fetch-ec2-metadata.service" "network-online.target" "nix-daemon.socket" ];
             wants = [ "fetch-ec2-metadata.service" "network-online.target" "nix-daemon.socket" ];
-            path = [ pkgs.coreutils pkgs.git ];
+            path = [ pkgs.coreutils pkgs.git pkgs.systemd ];
             serviceConfig = {
               Type = "oneshot";
               RemainAfterExit = true;
@@ -146,8 +146,23 @@ write_final_config() {
               fi
 
               install -m 0644 "$user_data" /etc/nixos/flake.nix
+
+              runner=/run/nixos-user-data-flake-apply
+              cat > "$runner" <<RUNNER_EOF
+              #!$${pkgs.runtimeShell}
+              set -eu
+
               $${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch --flake /etc/nixos
               printf '%s\n' "$new_hash" > "$applied_hash_file"
+RUNNER_EOF
+              chmod 0700 "$runner"
+
+              systemd-run \
+                --unit=nixos-user-data-flake-apply \
+                --collect \
+                --no-ask-password \
+                --service-type=exec \
+                "$${pkgs.runtimeShell}" "$runner"
             '';
           };