diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index 2247aeca4..e9f067e35 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -18,6 +18,10 @@
 
 #include <openssl/crypto.h>
 
+#if HAVE_SODIUM
+#include <sodium.h>
+#endif
+
 
 namespace nix {
 
@@ -126,6 +130,11 @@ void initNix()
     CRYPTO_set_locking_callback(opensslLockCallback);
 #endif
 
+#if HAVE_SODIUM
+    if (sodium_init() == -1)
+        throw Error("could not initialise libsodium");
+#endif
+
     loadConfFile();
 
     startSignalHandlerThread();
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 54394e921..e1ccece99 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -981,9 +981,6 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs)
     string publicKeyFile = *i++;
 
 #if HAVE_SODIUM
-    if (sodium_init() == -1)
-        throw Error("could not initialise libsodium");
-
     unsigned char pk[crypto_sign_PUBLICKEYBYTES];
     unsigned char sk[crypto_sign_SECRETKEYBYTES];
     if (crypto_sign_keypair(pk, sk) != 0)