Having trouble with NixOps and Datadog

Trying to get Datadog agent working on a couple machines. Trying out NixOps for the first time, using it to deploy the Datadog API key.

I can see the key is successfully created in /run/keys and it contains the expected value:

-rw-------  1 datadog keys  32 Mar 25 13:26 datadog_api_key

I’ve got datadog configured thusly:

datadog-agent = {
  enable = true;
  apiKeyFile = "/run/keys/datadog_api_key";
};

When I look in /var/log/datadog/agent.log I see

2022-03-25 13:26:33 UTC | CORE | ERROR | (pkg/forwarder/forwarder_health.go:112 in healthCheckLoop) | No valid api key found, reporting the forwarder as unhealthy.

Any ideas?