[Unit] Description=GCE Workload Certificate refresh [Service] Type=oneshot ExecStart=/usr/bin/gce_workload_cert_refresh # No [Install] section - this is controlled by gce-workload-cert.timer