diff --git a/hosts/nuos/configuration.nix b/hosts/nuos/configuration.nix
index dcfa389..2caab9e 100644
--- a/hosts/nuos/configuration.nix
+++ b/hosts/nuos/configuration.nix
@@ -158,6 +158,7 @@
       "secrets/token-flurry".file = ../../secrets/github/flurry.age;
       "secrets/token-nixconf".file = ../../secrets/github/nixconf.age;
       "secrets/nix-store-key".file = ../../secrets/nix-serve/private.age;
+      "secrets/radicale".file = ../../secrets/radicale/htpasswd.age;
     };
   };
 
@@ -201,7 +202,7 @@
         server.hosts = [ "[::1]:29341" ];
         auth = {
           type = "htpasswd";
-          htpasswd_filename = "/var/radicale_users";
+          htpasswd_filename = config.age.secrets."secrets/radicale".path;
           htpasswd_encryption = "bcrypt";
         };
       };
diff --git a/secrets/radicale/htpasswd.age b/secrets/radicale/htpasswd.age
new file mode 100644
index 0000000..e9f2d2a
Binary files /dev/null and b/secrets/radicale/htpasswd.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index d49e053..8e797db 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -6,8 +6,9 @@ in
   "restic/env.age".publicKeys = [ noa ];
   "restic/repo.age".publicKeys = [ noa ];
   "restic/password.age".publicKeys = [ noa ];
-  "github/flurry.age".publicKeys = [ nuOS ];
-  "github/nixconf.age".publicKeys = [ nuOS ];
-  "nix-serve/private.age".publicKeys = [ nuOS ];
+  "github/flurry.age".publicKeys = [ noa nuOS ];
+  "github/nixconf.age".publicKeys = [ noa nuOS ];
+  "nix-serve/private.age".publicKeys = [ noa nuOS ];
+  "radicale/htpasswd.age".publicKeys = [ noa nuOS ];
 }