diff --git a/modules/server/encrypt/vaultwarden.age b/modules/server/encrypt/vaultwarden.age
new file mode 100644
index 0000000..bb10ea7
--- /dev/null
+++ b/modules/server/encrypt/vaultwarden.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 QwbpPw plZ+smu/E5y1fTvzLTjioQAZ/G9KCmsz7FMdq3lf/Fk
+W8ye55GdzJPQOuIiJg2KbuP0/JcJstvdUSZPCjonfVo
+--- ZYFukRqb02JI1+iM9xw7EzMOxBnAEE/dw7p7cZ+45/I
+MV����D��^3Ӵ��<\(j�L�������43�*:U�3H�*9�����Ԙ��G=����@$�y}���������g�z^Y�"���Ә�$�g2�>=n:h/$�_�%ZᄦA��#�J��HG��ʢ�~��Vu((�G�:�������.y
\ No newline at end of file
diff --git a/modules/server/vaultwarden.nix b/modules/server/vaultwarden.nix
index a845333..ce61a39 100644
--- a/modules/server/vaultwarden.nix
+++ b/modules/server/vaultwarden.nix
@@ -27,6 +27,12 @@ in helpers.linuxAttrs {
   };
 
   config = mkIf (cfg.enable && cfg.vaultwarden.enable) {
+    age.secrets."vaultwarden" = {
+      symlink = true;
+      path = "/run/secrets/vaultwarden.env";
+      file = ./encrypt/vaultwarden.age;
+    };
+
     services.vaultwarden = let
       baseURL = if (cfg.caddy.enable && cfg.tailscale.enable)
         then "https://${hostname}.${cfg.tailscale.domain}/vault/"
@@ -35,17 +41,28 @@ in helpers.linuxAttrs {
     in {
       enable = true;
       dbBackend = "sqlite";
+      environmentFile = "/run/secrets/vaultwarden.env";
       config = {
         IP_HEADER = "X-Real-IP";
-        ADMIN_TOKEN = "$argon2id$v=19$m=65540,t=3,p=4$+5A5H6YiN6OxyrFggkrft8Mm+sxgh/tL3USbaYFZ/h8$qj8NjE+COL4WXjmjkPWSQk7iLfhaBfBtV6k06Bql3CQ";
-        PASSWORD_HINTS_ALLOWED = "false";
-        SIGNUPS_ALLOWED = "false";
         DOMAIN = baseURL;
         WEBSOCKET_ADDRESS = "127.0.0.1";
         ROCKET_ADDRESS = "127.0.0.1";
         WEBSOCKET_PORT = toString cfg.vaultwarden.websocketPort;
         ROCKET_PORT = toString cfg.vaultwarden.port;
         ROCKET_LIMITS = "{json=10485760}";
+
+        LOGIN_RATELIMIT_SECONDS = "60";
+        LOGIN_RATELIMIT_MAX_BURST = "10";
+        ADMIN_RATELIMIT_SECONDS = "300";
+        ADMIN_RATELIMIT_MAX_BURST = "3";
+
+        PASSWORD_HINTS_ALLOWED = "false";
+        SHOW_PASSWORD_HINT = "false";
+        SIGNUPS_ALLOWED = "false";
+        INVITATIONS_ALLOWED = "false";
+        EMERGENCY_ACCESS_ALLOWED = "false";
+        SENDS_ALLOWED = "false";
+        ORG_CREATION_USERS = "none";
       };
     };
   };
diff --git a/secrets.nix b/secrets.nix
index f08468e..118b299 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -10,6 +10,7 @@ in
   "./modules/server/encrypt/rclone.conf.age".publicKeys = keys;
   "./modules/server/encrypt/tangled-knot-ssh.age".publicKeys = keys;
   "./modules/server/encrypt/gitconfig.age".publicKeys = keys;
+  "./modules/server/encrypt/vaultwarden.age".publicKeys = keys;
 
   "./modules/router/encrypt/pppoe-options.age".publicKeys = keys;