diff --git a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix
index c6afb80..ab1785b 100644
--- a/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix
+++ b/config/hosts/public-web-static/virtualHosts/staging.diday.org.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 
 let
   domain = "staging.diday.org";
@@ -6,20 +6,14 @@ let
   deployUser = "diday-website-deploy";
 in
 {
-  security.acme.certs."${domain}" = {
-    domain = "staging.diday.org";
-    extraDomainNames = [ "*.staging.diday.org" ];
-    group = "nginx";
-    dnsResolver = "45.54.76.1:53";
-    dnsProvider = "desec";
-    environmentFile = config.sops.secrets."staging.diday.org/lego.env".path;
-  };
-
   services.nginx.virtualHosts = {
     "*.${domain}" = {
-      useACMEHost = "${domain}";
       forceSSL = true;
 
+      # https://discourse.nixos.org/t/where-can-i-get-snakeoil-certificates/14628/4
+      sslCertificate = "${pkgs.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
+      sslCertificateKey = "${pkgs.path}/nixos/tests/common/acme/server/acme.test.key.pem";
+
       listen = [
         {
           addr = "[::]";
@@ -78,6 +72,4 @@ in
   systemd.tmpfiles.rules = [
     "d ${dataDir} 0755 ${deployUser} ${deployUser}"
   ];
-
-  sops.secrets."staging.diday.org/lego.env" = {};
 }