diff --git a/config/services/keycloak.nix b/config/services/keycloak.nix
index f128d581..3f8956eb 100644
--- a/config/services/keycloak.nix
+++ b/config/services/keycloak.nix
@@ -2,7 +2,7 @@
   keystore-pass = "zZX3eS";
 in {
   services.keycloak = {
-    enable = true;
+    enable = builtins.getEnv "CI_PLATFORM" == "impure";
     package = (pkgs.keycloak.override {
       jre = pkgs.openjdk11;
     });