diff --git a/lib.nix b/lib.nix
index 7cd283a..876aa78 100644
--- a/lib.nix
+++ b/lib.nix
@@ -31,7 +31,7 @@ rec {
       (pkgs.runCommand "value-to-b64" {} "echo '${value}' | ${pkgs.coreutils}/bin/base64 -w0 > $out");
 
   mkValueOrSecretOption = {...}@options: mkOption ({
-    type = types.either types.str (types.submodule {
+    type = types.nullOr (types.either types.str (types.submodule {
       options.secret = mkOption {
         description = "Name of the secret where password is stored";
         type = types.str;
@@ -42,7 +42,7 @@ rec {
         type = types.str;
         default = "password";
       };
-    });
+    }));
 
     apply = value:
       if isAttrs value