diff --git a/roles/prosody/templates/prosody.cfg.lua.j2 b/roles/prosody/templates/prosody.cfg.lua.j2
index 3ae1d3a8f24f2c731a9af60e5c74a2deda16dd45..71ff87b64761292895a95365be6dabdb73787644 100644
--- a/roles/prosody/templates/prosody.cfg.lua.j2
+++ b/roles/prosody/templates/prosody.cfg.lua.j2
@@ -42,8 +42,8 @@ allow_registration = false;
 -- These are the SSL/TLS-related settings. If you don't want
 -- to use SSL/TLS, you may comment or remove this
 ssl = {
-  key = "{{ prosody_tls_key }}";
-  certificate = "{{ prosody_tls_certificate }}";
+  key = "/etc/ssl/private/{{ prosody_tls_key | basename }}";
+  certificate = "/etc/ssl/certs/{{ prosody_tls_certificate | basename }}";
 }
 
 -- Ports on which to have direct TLS/SSL.