diff --git a/common.sh b/common.sh
index 00e3191..9e1e042 100644
--- a/common.sh
+++ b/common.sh
@@ -117,6 +117,7 @@ finish() {
 finish_ci() {
 	ssh-add -d /run/secrets/ci_ed25519_key
 	ssh-add -d /run/secrets/ci_signing_ed25519_key
+	pkill ssh-agent # TODO: https://github.com/systemd/systemd/pull/28035
 	exit 0
 }
 
diff --git a/lib/default.nix b/lib/default.nix
index 0f4ecc9..3736992 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -41,6 +41,9 @@ let
     value = {
       script = mkCronScript "${job.name}_script" job.script;
       inherit (job) startAt path;
+      serviceConfig = {
+        OneShot = true;
+      };
     };
   };
   jobToService = job: {
@@ -48,7 +51,10 @@ let
     value = {
       script = mkCronScript "${job.name}_script" job.script;
       inherit (job) startAt path;
-      serviceConfig = { User = "${job.user}"; };
+      serviceConfig = {
+        User = "${job.user}";
+        OneShot = true;
+      };
     };
   };
   buildShell = pkgs: