diff --git a/nixosModules/clanCore/vars/secret/sops/collectFiles.nix b/nixosModules/clanCore/vars/secret/sops/collectFiles.nix
deleted file mode 100644
index 697c59861..000000000
--- a/nixosModules/clanCore/vars/secret/sops/collectFiles.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-# collectFiles helper function
-{
-  lib ? import <nixpkgs/lib>,
-}:
-let
-  inherit (lib)
-    filterAttrs
-    mapAttrsToList
-    ;
-
-  relevantFiles = filterAttrs (
-    _name: f: f.secret && f.deploy && (f.neededFor == "users" || f.neededFor == "services")
-  );
-
-  collectFiles =
-    generators:
-    builtins.concatLists (
-      mapAttrsToList (
-        gen_name: generator:
-        mapAttrsToList (fname: file: {
-          name = fname;
-          generator = gen_name;
-          neededForUsers = file.neededFor == "users";
-          inherit (generator) share;
-          inherit (file)
-            owner
-            group
-            mode
-            restartUnits
-            ;
-        }) (relevantFiles generator.files)
-      ) generators
-    );
-in
-collectFiles
diff --git a/nixosModules/clanCore/vars/secret/sops/default.nix b/nixosModules/clanCore/vars/secret/sops/default.nix
index 5653fe496..745bbe73b 100644
--- a/nixosModules/clanCore/vars/secret/sops/default.nix
+++ b/nixosModules/clanCore/vars/secret/sops/default.nix
@@ -7,19 +7,9 @@
 }:
 let
 
-  collectFiles = import ./collectFiles.nix { inherit lib; };
+  mapGeneratorsToSopsSecrets = import ./generators-to-sops.nix { inherit lib; };
 
   machineName = config.clan.core.settings.machine.name;
-
-  secretPath =
-    secret:
-    if secret.share then
-      config.clan.core.settings.directory + "/vars/shared/${secret.generator}/${secret.name}/secret"
-    else
-      config.clan.core.settings.directory
-      + "/vars/per-machine/${machineName}/${secret.generator}/${secret.name}/secret";
-
-  vars = collectFiles config.clan.core.vars.generators;
 in
 {
   config.clan.core.vars.settings = lib.mkIf (config.clan.core.vars.settings.secretStore == "sops") {
@@ -39,28 +29,13 @@ in
   };
 
   config.sops = lib.mkIf (config.clan.core.vars.settings.secretStore == "sops") {
-
-    secrets = lib.listToAttrs (
-      map (secret: {
-        name = "vars/${secret.generator}/${secret.name}";
-        value = {
-          inherit (secret)
-            owner
-            group
-            mode
-            neededForUsers
-            ;
-          sopsFile = builtins.path {
-            name = "${secret.generator}_${secret.name}";
-            path = secretPath secret;
-          };
-          format = "binary";
-        }
-        // (lib.optionalAttrs (_class == "nixos") {
-          inherit (secret) restartUnits;
-        });
-      }) (builtins.filter (x: builtins.pathExists (secretPath x)) vars)
-    );
+    #
+    secrets = mapGeneratorsToSopsSecrets {
+      inherit machineName;
+      directory = config.clan.core.settings.directory;
+      class = _class;
+      generators = config.clan.core.vars.generators;
+    };
 
     # To get proper error messages about missing secrets we need a dummy secret file that is always present
     defaultSopsFile = lib.mkIf config.sops.validateSopsFiles (
diff --git a/nixosModules/clanCore/vars/secret/sops/generators-to-sops.nix b/nixosModules/clanCore/vars/secret/sops/generators-to-sops.nix
new file mode 100644
index 000000000..d5a391609
--- /dev/null
+++ b/nixosModules/clanCore/vars/secret/sops/generators-to-sops.nix
@@ -0,0 +1,77 @@
+# This file maps generators to sops.secrets
+# TODO(@davHau): add tests
+{
+  lib ? import <nixpkgs/lib>,
+  # Can be mocked for testing
+  pathExists ? builtins.pathExists,
+}:
+let
+  inherit (lib)
+    filterAttrs
+    mapAttrsToList
+    ;
+
+  relevantFiles = filterAttrs (
+    _name: f: f.secret && f.deploy && (f.neededFor == "users" || f.neededFor == "services")
+  );
+
+  extractSecretDefinitions =
+    generators:
+    builtins.concatLists (
+      mapAttrsToList (
+        gen_name: generator:
+        mapAttrsToList (fname: file: {
+          name = fname;
+          generator = gen_name;
+          neededForUsers = file.neededFor == "users";
+          inherit (generator) share;
+          inherit (file)
+            owner
+            group
+            mode
+            restartUnits
+            ;
+        }) (relevantFiles generator.files)
+      ) generators
+    );
+
+  mapGeneratorsToSopsSecrets =
+    {
+      machineName,
+      directory,
+      class,
+      generators,
+    }:
+    assert lib.assertMsg (class == "nixos" || class == "darwin")
+      "Error trying to map 'var.generators' to 'sops.secrets': class must be 'nixos' or 'darwin', got: ${class}";
+    let
+      getSecretPath =
+        secret:
+        let
+          scope = if secret.share then "shared" else "per-machine/${machineName}";
+        in
+        "${directory}/vars/${scope}/${secret.generator}/${secret.name}/secret";
+    in
+    lib.listToAttrs (
+      map (secret: {
+        name = "vars/${secret.generator}/${secret.name}";
+        value = {
+          inherit (secret)
+            owner
+            group
+            mode
+            neededForUsers
+            ;
+          sopsFile = builtins.path {
+            name = "${secret.generator}_${secret.name}";
+            path = getSecretPath secret;
+          };
+          format = "binary";
+        }
+        // (lib.optionalAttrs (class == "nixos") {
+          inherit (secret) restartUnits;
+        });
+      }) (builtins.filter (x: pathExists (getSecretPath x)) (extractSecretDefinitions generators))
+    );
+in
+mapGeneratorsToSopsSecrets