diff --git a/hosts/argon/configuration.nix b/hosts/argon/configuration.nix
index d67967b..7159fd6 100644
--- a/hosts/argon/configuration.nix
+++ b/hosts/argon/configuration.nix
@@ -1,17 +1,7 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
-# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
 
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 
-let
-  # luks name -> partition uuid, mounted at /mnt/<name>
-  drives = {
-    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-  };
-  key = name: "/etc/nixos/keys/${name}.key";
-in
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -19,6 +9,7 @@ in
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
+    ../../modules/nixos/data-drives.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/greetd.nix
     ../../modules/nixos/locales.nix
@@ -46,22 +37,12 @@ in
   };
   hardware.amdgpu.initrd.enable = true;
 
-  # encrypted data drives
-  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
-  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
-    device = "/dev/disk/by-uuid/${uuid}";
-    keyFile = key name;
-    # trim for ssds, ignored by drives without discard support
-    allowDiscards = true;
-  }) drives;
-  fileSystems = lib.mapAttrs' (
-    name: _:
-    lib.nameValuePair "/mnt/${name}" {
-      device = "/dev/mapper/${name}";
-      fsType = "ext4";
-      options = [ "nofail" ];
-    }
-  ) drives;
+  # encrypted data drives, see data-drives.nix
+  local.dataDrives = {
+    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    data2 = "8312edae-9247-481b-a313-52a7f848f027";
+    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
+  };
 
   environment.systemPackages = with pkgs; [
     amdgpu_top
diff --git a/hosts/default/hardware-configuration.nix b/hosts/default/hardware-configuration.nix
index 42645ca..f872938 100644
--- a/hosts/default/hardware-configuration.nix
+++ b/hosts/default/hardware-configuration.nix
@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
   fileSystems."/home" = {
diff --git a/modules/nixos/data-drives.nix b/modules/nixos/data-drives.nix
new file mode 100644
index 0000000..6b5dfd5
--- /dev/null
+++ b/modules/nixos/data-drives.nix
@@ -0,0 +1,37 @@
+# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
+# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
+# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
+# on the unencrypted /boot.
+
+{ config, lib, ... }:
+
+let
+  drives = config.local.dataDrives;
+in
+{
+  options.local.dataDrives = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    default = { };
+    example = {
+      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    };
+    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
+  };
+
+  config = lib.mkIf (drives != { }) {
+    environment.etc.crypttab.text = lib.concatStrings (
+      lib.mapAttrsToList (
+        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
+      ) drives
+    );
+
+    fileSystems = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "/mnt/${name}" {
+        device = "/dev/mapper/${name}";
+        fsType = "ext4";
+        options = [ "nofail" ];
+      }
+    ) drives;
+  };
+}