diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix
index 6d19994..7155ad5 100644
--- a/hw/dixie/analysis.nix
+++ b/hw/dixie/analysis.nix
@@ -154,6 +154,7 @@ in
       description = "dropsonde2: set dropsonde role password + create extensions";
       wants = [ "postgresql-setup.service" ];
       after = [ "postgresql-setup.service" "postgresql.service" ];
+      path = [ config.services.postgresql.package ];
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
@@ -162,21 +163,19 @@ in
         Restart = "on-failure";
         RestartSec = "10s";
         LoadCredential = [ "dropsonde-pg-password:/root/dropsonde-pg" ];
-        ExecStart = ''${pkgs.coreutils}/bin/bash <<'BASH'
-set -euo pipefail
-pw=$(cat "$CREDENTIALS_DIRECTORY/dropsonde-pg-password")
-psql -v ON_ERROR_STOP=1 -v pw="$pw" -d postgres <<'SQL'
-ALTER ROLE dropsonde WITH LOGIN PASSWORD :'pw';
-SQL
-psql -v ON_ERROR_STOP=1 -d dropsonde <<'SQL'
-CREATE EXTENSION IF NOT EXISTS timescaledb;
-CREATE EXTENSION IF NOT EXISTS postgis;
-CREATE EXTENSION IF NOT EXISTS h3;
-CREATE EXTENSION IF NOT EXISTS h3_postgis CASCADE;
-SQL
-BASH
-'';
       };
+      script = ''
+        pw=$(cat "$CREDENTIALS_DIRECTORY/dropsonde-pg-password")
+        psql -v ON_ERROR_STOP=1 -v pw="$pw" -d postgres <<'SQL'
+        ALTER ROLE dropsonde WITH LOGIN PASSWORD :'pw';
+        SQL
+        psql -v ON_ERROR_STOP=1 -d dropsonde <<'SQL'
+        CREATE EXTENSION IF NOT EXISTS timescaledb;
+        CREATE EXTENSION IF NOT EXISTS postgis;
+        CREATE EXTENSION IF NOT EXISTS h3;
+        CREATE EXTENSION IF NOT EXISTS h3_postgis CASCADE;
+        SQL
+      '';
       wantedBy = [ "multi-user.target" ];
     };
   };