diff --git a/modules/grafana/module.json b/modules/grafana/module.json
index a4317f6..8ae941f 100644
--- a/modules/grafana/module.json
+++ b/modules/grafana/module.json
@@ -39,6 +39,13 @@
       "mode": "0700",
       "owner": "472:472"
     },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/grafana-module/server.env",
+      "mode": "0600",
+      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
+    },
     {
       "id": "server",
       "type": "container",
@@ -48,12 +55,12 @@
         "3000"
       ],
       "volumes": [
-        "/services/grafana/data:/var/lib/grafana",
-        "/var/lib/grafana-module/admin.secret:/run/secrets/admin:ro"
+        "/services/grafana/data:/var/lib/grafana"
       ],
-      "env": {
-        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
-      }
+      "env-file": [
+        "/var/lib/grafana-module/server.env"
+      ],
+      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
     },
     {
       "id": "runtime-config",
@@ -115,6 +122,5 @@
         "from": "Dockerfile"
       }
     ]
-  },
-  "secrets-owner": "472:472"
+  }
 }