diff --git a/nixos/arion-riverside/arion-compose.nix b/nixos/arion-riverside/arion-compose.nix
index c04c7fe..8a2c25a 100644
--- a/nixos/arion-riverside/arion-compose.nix
+++ b/nixos/arion-riverside/arion-compose.nix
@@ -7,7 +7,7 @@
   services = {
     app = {
       service = {
-        image = "forge.quinefoundation.com/ironmagma/riverside@sha256:6ad578b0668ac91f37fc3677ce12960b5eeb23c3ba7238e1ba137d35e60fea58";
+        image = "forge.quinefoundation.com/ironmagma/riverside@sha256:ddfff836d45e8496358dd4709ea58a6c2041e6cdf0bfa33f42868d2626512d4a";
         container_name = "riverside";
         restart = "unless-stopped";
         networks = [ "riverside" ];
diff --git a/nixos/secrets/paperless.age b/nixos/secrets/paperless.age
new file mode 100644
index 0000000..78817b3
Binary files /dev/null and b/nixos/secrets/paperless.age differ