diff --git a/machines/web01/ntfy-sh.nix b/machines/web01/ntfy-sh.nix
index e3b5411..bc03aa3 100644
--- a/machines/web01/ntfy-sh.nix
+++ b/machines/web01/ntfy-sh.nix
@@ -1,4 +1,4 @@
-_:
+{ config, ... }:
 
 let host = "push.dgnum.eu";
 
@@ -23,4 +23,7 @@ in {
       proxyWebsockets = true;
     };
   };
+
+  systemd.services.ntfy-sh.serviceConfig.EnvironmentFile =
+    [ config.age.secrets."ntfy_sh-environment_file".path ];
 }
diff --git a/machines/web01/secrets/ntfy_sh-environment_file b/machines/web01/secrets/ntfy_sh-environment_file
new file mode 100644
index 0000000..2a0bcc0
Binary files /dev/null and b/machines/web01/secrets/ntfy_sh-environment_file differ
diff --git a/machines/web01/secrets/secrets.nix b/machines/web01/secrets/secrets.nix
index 5ab0979..75cdc98 100644
--- a/machines/web01/secrets/secrets.nix
+++ b/machines/web01/secrets/secrets.nix
@@ -4,6 +4,7 @@ let
 in lib.setDefault { inherit publicKeys; } [
   "acme-certs_secret"
   "named-bind_dnskeys_conf"
+  "ntfy_sh-environment_file"
   "plausible_admin-user-password-file"
   "plausible_secret-key-base-file"
   "plausible_release-cookie-file"