diff --git a/modules/spark-wallet.nix b/modules/spark-wallet.nix
index 8a0f6a1..cd2a860 100644
--- a/modules/spark-wallet.nix
+++ b/modules/spark-wallet.nix
@@ -89,7 +89,7 @@ in {
         User = "spark-wallet";
         Restart = "on-failure";
         RestartSec = "10s";
-        ReadWritePaths = "/var/lib/onion-chef";
+        ReadWritePaths = mkIf cfg.onion-service "/var/lib/onion-chef";
       } // (if cfg.enforceTor
             then nix-bitcoin-services.allowTor
             else nix-bitcoin-services.allowAnyIP)