diff --git a/modules/build-agent/files/mesh-build.slice b/modules/build-agent/files/mesh-build.slice
index 0365ee70..6c8b417a 100644
--- a/modules/build-agent/files/mesh-build.slice
+++ b/modules/build-agent/files/mesh-build.slice
@@ -4,7 +4,7 @@
 # agent starts every container with --cgroup-parent=mesh-build.slice. The weights only bind while the machine
 # is busy, so an idle machine still builds at full speed; the memory limits are the part that always binds.
 [Slice]
-CPUWeight=${config:cpu-weight}
-IOWeight=${config:io-weight}
-MemoryHigh=${config:memory-high}
-MemoryMax=${config:memory-max}
+CPUWeight=${setting:cpu-weight}
+IOWeight=${setting:io-weight}
+MemoryHigh=${setting:memory-high}
+MemoryMax=${setting:memory-max}
diff --git a/modules/build-agent/manifest_test.go b/modules/build-agent/manifest_test.go
index 2593d2e1..388494d5 100644
--- a/modules/build-agent/manifest_test.go
+++ b/modules/build-agent/manifest_test.go
@@ -211,7 +211,7 @@ func TestTheBuildSliceCarriesTheMachinesLimits(t *testing.T) {
 		if c, ok := m.Config[key]; !ok || c.Default == nil {
 			t.Errorf("1798/AC2: setting %s is missing or has no default", key)
 		}
-		if !strings.Contains(string(slice), property+"=${config:"+key+"}") {
+		if !strings.Contains(string(slice), property+"=${setting:"+key+"}") {
 			t.Errorf("1798/AC2: the slice does not set %s from %s", property, key)
 		}
 	}
diff --git a/modules/build-agent/module.json b/modules/build-agent/module.json
index 4ec86cca..a85ebd1a 100644
--- a/modules/build-agent/module.json
+++ b/modules/build-agent/module.json
@@ -107,6 +107,7 @@
       "type": "file",
       "path": "/etc/systemd/system/mesh-build.slice",
       "mode": "0644",
+      "trusted": false,
       "template": "files/mesh-build.slice"
     },
     {