diff --git a/hosts/marvin/services/paperless.nix b/hosts/marvin/services/paperless.nix
--- a/hosts/marvin/services/paperless.nix
+++ b/hosts/marvin/services/paperless.nix
@@ -14,7 +14,6 @@ enable = true;
     inherit (d) port;
     address = "0.0.0.0";
     domain = d.extUrl;
-    passwordFile = sec.paperless-admin-password.path;
     database.createLocally = true;
     configureTika = true;
     settings = {
@@ -28,6 +27,7 @@ PAPERLESS_EMAIL_USE_SSL = true;
       PAPERLESS_APP_TITLE = "dish Docs";
       PAPERLESS_TASK_WORKERS = 3;
     };
+    environmentFile = sec.paperless-secrets.path;
   };
 
   age.secrets = mkServiceSecrets "paperless" ./secrets [