diff --git a/nixos/hedgedoc.nix b/nixos/hedgedoc.nix
index 5f80166..91a1a1d 100644
--- a/nixos/hedgedoc.nix
+++ b/nixos/hedgedoc.nix
@@ -1,13 +1,18 @@
+{ config, ... }:
+
 let
   domain = "pad.srid.ca";
   port = 9112;
 in
 {
+  age.secrets."hedgedoc.env" = {
+    file = ../secrets/hedgedoc.env.age;
+    owner = "hedgedoc";
+  };
   services.hedgedoc = {
     enable = true;
 
-    # GitHub secrets set in colmena (see flake.nix)
-    environmentFile = "/run/keys/hedgedoc.env";
+    environmentFile = config.age.secrets."hedgedoc.env".path;
 
     settings = {
       # URL config