diff --git a/hosts/profiles/wallabag/default.nix b/hosts/profiles/wallabag/default.nix
index fd671891..b2a910a9 100644
--- a/hosts/profiles/wallabag/default.nix
+++ b/hosts/profiles/wallabag/default.nix
@@ -1,6 +1,15 @@
 { pkgs, config, lib, ... }:
 
+let
+  wallabag-password = builtins.readFile "/run/agenix/wallabag_password";
+  wallabag-secret = builtins.readFile "/run/agenix/wallabag_secret";
+in
 {
+  age.secrets.wallabag-password.file = "/run/agenix/wallabag_password";
+  age.secrets.wallabag-password.owner = "wallabag";
+  age.secrets.wallabag-secret.file = "/run/agenix/wallabag_secret";
+  age.secrets.wallabag-secret.owner = "wallabag";
+
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_11;
@@ -28,7 +37,7 @@
           database_name: wallabag
           database_user: wallabag
           # TODO agenix
-          database_password: wallabag 
+          database_password: ${wallabag-password}
           # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
           database_path: ~
           database_table_prefix: wallabag_
@@ -51,7 +60,7 @@
 
           # A secret key that's used to generate certain security-related tokens
           # TODO agenix
-          secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
+          secret: ${wallabag-secret} SAFGOECRIlfal89oe6u0(*^dsaaih961
 
           # two factor stuff
           twofactor_auth: true
diff --git a/secrets/wallabag-password.age b/secrets/wallabag-password.age
new file mode 100644
index 00000000..4f8928a5
--- /dev/null
+++ b/secrets/wallabag-password.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 K2vF/Q 71YyNzHijmSYXrZM9XCpTuz+5pp5xelrfrsDALqEqWg
+hukblsPnp+yj9O5y3YU4NT2PLxp0WGtsEuOZlxx06OI
+-> J#cy5AG-grease 9'>
+YNU2IHnG1ELEEKThpSVN357BDExcNcV5npG7P/J0/jBJYofo47p3
+--- L807Hrt3wcqdJI7s9VOWIvJ4MsFcoylXUBMiMwIrJb8
+j��j`���P�;�-$
����r�p�L�A�j�El�{��H{�
\ No newline at end of file
diff --git a/secrets/wallabag-secret.age b/secrets/wallabag-secret.age
new file mode 100644
index 00000000..a6aec461
--- /dev/null
+++ b/secrets/wallabag-secret.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 K2vF/Q rJ+Bv933siTbr1bFbjS8yZFAJNJVFHGSaTRKL5voKEY
+XLVaUEDtOSHciozDfqVc6tpYi1tGpu9p+lR6lv5R1Pc
+-> <$ra')-grease
+d6H6lDsqhGnmRjyAJzzpcb1z4azaZ0CSzS24o1OMDt+wo+PIp5bQ/xgsD2HEOveB
+n2A/GSyDv3Bv
+--- jWBWzIifCy4DUMo18Oi/HflStwhxABHgrx1LsAdryFE
+^KQZ��9��B�O�щp��#�JL��Z��	%?Q�\��i��f�b���˸_�4��z'��P
\ No newline at end of file