diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index 6d2337a..1393056 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -577,7 +577,7 @@ in {
     # PRG Cloudflare DDNS updater - split into a single-run upstream script and a wrapper that loops records
     environment.etc."cloudflare-ddns/update-single.sh" = {
       text = ''
-        #!/usr/bin/env bash
+        #!${pkgs.bash}/bin/bash
         ## K0p1-Git cloudflare-ddns-updater (packaged copy)
         ## Upstream: https://github.com/K0p1-Git/cloudflare-ddns-updater
         ## Author: K0p1-Git
@@ -711,7 +711,7 @@ in {
 
     environment.etc."cloudflare-ddns/update.sh" = {
       text = ''
-        #!/usr/bin/env bash
+        #!${pkgs.bash}/bin/bash
         set -euo pipefail
 
         # Wrapper: source env, map tokens, loop declared records and call the upstream single-run script
@@ -741,7 +741,7 @@ in {
             export record_name="$r.${domain}"
           fi
           # Invoke the single-run script explicitly with the system's bash via env to avoid /bin/bash shebang issues
-          /usr/bin/env bash /etc/cloudflare-ddns/update-single.sh || true
+          ${pkgs.bash}/bin/bash /etc/cloudflare-ddns/update-single.sh || true
         done
 
       '';