diff --git a/nixos/linux.nix b/nixos/linux.nix
index c027f4b..8f17bb4 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -143,15 +143,14 @@ in {
 
       "webdav" = {
         autoStart = true;
-        image = "dgraziotin/nginx-webdav-nononsense";
+        image = "quineglobal/nginx-webdav-nononsense@sha256:86002d386e433c3ed1d265d3aa7f921f96fb678651a913aaa92af8fb78870b1c";
         volumes = [
           "/mnt/webdav/data:/data"
           "/mnt/webdav/config:/config"
         ];
         environment = {
-          "WEBDAV_USERNAME" = "foo";
-          # TODO
-          "WEBDAV_PASSWORD" = "bar";
+          "WEBDAV_USERNAME" = "ironmagma";
+          "WEBDAV_PASSWORD_FILE" = config.age.secrets."webdav".path;
           "TZ" = "America/Anchorage";
 
           "PUID" = "60"; # nginx user
diff --git a/nixos/secrets/default.nix b/nixos/secrets/default.nix
index 819eae3..6c1af5e 100644
--- a/nixos/secrets/default.nix
+++ b/nixos/secrets/default.nix
@@ -5,4 +5,7 @@ in {
   #  NEARLYFREESPEECH_API_KEY
   #  NEARLYFREESPEECH_LOGIN
   "./nearlyfreespeech.age".publicKeys = [mainframePublicKey];
+
+  # WEBDAV_PASSWORD
+  "./webdav.age".publicKeys = [mainframePublicKey];
 }
diff --git a/nixos/secrets/webdav.nix b/nixos/secrets/webdav.nix
new file mode 100644
index 0000000..edc693a
--- /dev/null
+++ b/nixos/secrets/webdav.nix
@@ -0,0 +1,8 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE5GRC92ZyBHVDRM
+NHJMcWV2ejZoUU5LRHF3SHJRdk4zTXlORkpMQzYzbnpoR0tHUEcwCnVoY282RUt0
+NG1GR3NramxoRmIrVUk4ekgrWFJvOGhjRUpUVGJvdmhYb1UKLS0tIHRTVmRtbEgw
+ekVmWGxZU3dLL2M0NFB1bG44K0QxRDQxZzROSDNmbGU2bTgKt1pkiwQwDRJTKFrP
+aoWZ8aHxfQPrWFOWho/+OzZO/Elx7O5gdmvlvJlUltWYdAhV4sjE6phKlhcmjyEN
+CFQ3128ZUbM=
+-----END AGE ENCRYPTED FILE-----