diff --git a/.just/machine.just b/.just/machine.just
index 1ab5ca8..098e101 100644
--- a/.just/machine.just
+++ b/.just/machine.just
@@ -2,10 +2,10 @@
 
 [doc('List machines')]
 @list:
-  ls -1 ../systems/x86_64-linux/
+    ls -1 ../systems/x86_64-linux/
 
-[no-exit-message]
 [doc('Update the target machine')]
+[no-exit-message]
 @update machine:
-  just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | tr '\n' ' ')"
-  nixos-rebuild switch --use-remote-sudo --target-host {{ machine }} --flake ..#{{ machine }}
\ No newline at end of file
+    just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')"
+    nixos-rebuild switch --use-remote-sudo --target-host {{ machine }} --flake ..#{{ machine }}
diff --git a/modules/nixos/services/authentication/zitadel/default.nix b/modules/nixos/services/authentication/zitadel/default.nix
index 8a80902..ee06900 100644
--- a/modules/nixos/services/authentication/zitadel/default.nix
+++ b/modules/nixos/services/authentication/zitadel/default.nix
@@ -335,14 +335,6 @@ in
     ;
 
     append = attrList: set: set // (listToAttrs attrList);
-    forEach = src: key: set:
-    let
-      _key = concatMapStringsSep "_" (k: "\${item.${k}}") key;
-    in
-    {
-      forEach = "{ for item in ${src} : \"${_key}\" => item }";
-    }
-    // set;
 
     config' = config;
 
@@ -352,7 +344,21 @@ in
 
       modules = [
         ({ config, lib, ... }: {
-          config = {
+          config =
+          let
+            forEach = src: key: set:
+            let
+              _key = concatMapStringsSep "_" (k: "\${item.${k}}") key;
+            in
+            {
+              forEach = lib.tfRef ''{
+                for item in ${src} :
+                "''${item.org}_''${item.name}" => item
+              }'';
+            }
+          // set;
+          in
+          {
             terraform.required_providers.zitadel = {
               source = "zitadel/zitadel";
               version = "2.2.0";