diff --git a/flake.lock b/flake.lock
index 861cd0e..f0739c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -455,11 +455,11 @@
         "quickshell": "quickshell"
       },
       "locked": {
-        "lastModified": 1727486385,
-        "narHash": "sha256-+zKlAyVmmHkvdN5VpOAv7U5/SWY4JR/ZJjUscjHRLc0=",
+        "lastModified": 1727571386,
+        "narHash": "sha256-bk34Wr2VjFb+3CFATI3zzCkRa2wtDxFFgkMkNhRx5GI=",
         "ref": "refs/heads/main",
-        "rev": "6cd1de8984c7544b4c43b88c9aa4ca61fde1f229",
-        "revCount": 49,
+        "rev": "5309cf0de60bbcf2be5d75ccb2fc31d499525daa",
+        "revCount": 53,
         "type": "git",
         "url": "https://codeberg.org/nydragon/nysh"
       },
diff --git a/flake.nix b/flake.nix
index 84851e4..48de153 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,7 +58,7 @@
       ];
 
       perSystem =
-        { pkgs, ... }:
+        { pkgs, inputs', ... }:
         {
           formatter = pkgs.nixfmt-rfc-style;
           devShells.default = pkgs.mkShell {
@@ -67,6 +67,7 @@
               nixfmt-rfc-style
               nodePackages.prettier
               typos
+              inputs'.agenix.packages.default
             ];
             shellHook = ''
               ${pkgs.pre-commit}/bin/pre-commit install -f
diff --git a/options/navidrome.nix b/options/navidrome.nix
index 1f832a2..6b421e1 100644
--- a/options/navidrome.nix
+++ b/options/navidrome.nix
@@ -62,5 +62,9 @@ in
         MusicFolder = cfg.library.path;
       } // cfg.settings;
     };
+
+    systemd.services.navidrome.serviceConfig = {
+      EnvironmentFile = config.age.secrets.navidrome.path;
+    };
   };
 }
diff --git a/secrets/navidrome.age b/secrets/navidrome.age
new file mode 100644
index 0000000..eedc7ef
Binary files /dev/null and b/secrets/navidrome.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index af512cb..46d0481 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -2,14 +2,16 @@ let
   raptus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdpjGR/pV1roktZdKIVVWqds0JB+x1ksfyQmYPMLK7o";
   marr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMh2nUUKt3xsKiwZUuo6HgvR3lr7rRAl0SOH/502sFP";
   brontes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgknH3OPazZNhH5xkYfXBcYpI3TXj/eRp0/zzjtVJBf";
-
+  shan = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnASO1+h9tUYsNrsePcmxFLpKBkyCXbcZB9W7f5Yt5U";
   devices = [
     marr
     raptus
     brontes
+    shan
   ];
 in
 {
   "couchdb.age".publicKeys = devices;
   "rustypaste.age".publicKeys = devices;
+  "navidrome.age".publicKeys = devices;
 }