diff --git a/configs/nixos/modules/services/navidrome.nix b/configs/nixos/modules/services/navidrome.nix
index 3db64cd..81f7d5f 100644
--- a/configs/nixos/modules/services/navidrome.nix
+++ b/configs/nixos/modules/services/navidrome.nix
@@ -5,16 +5,21 @@
   ...
 }:
 let
-  writeEnvironmentFile = pkgs.writeShellScript "navidrome-environment" ''
+  configScript = pkgs.writeShellScript "navidrome-config" ''
     set -eu
 
     umask 077
     api_key="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-api-key")"
     secret="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-secret")"
 
-    cat > /run/navidrome/navidrome.env <<EOF
-    ND_LASTFM_APIKEY=$api_key
-    ND_LASTFM_SECRET=$secret
+    cat > /run/navidrome/navidrome.toml <<EOF
+    Address = "0.0.0.0"
+    Port = 4533
+    DataFolder = "${config.modules.services.navidrome.dataDir}"
+    MusicFolder = "${config.modules.services.navidrome.libraryDir}"
+    EnableSharing = true
+    LastFM.ApiKey = "$api_key"
+    LastFM.Secret = "$secret"
     EOF
   '';
 in
@@ -60,28 +65,31 @@ in
         home = config.modules.services.navidrome.dataDir;
       };
 
-      services.navidrome = {
-        enable = true;
-        user = "navidrome";
-        group = "storage";
-        environmentFile = "/run/navidrome/navidrome.env";
-        openFirewall = true;
-        settings = {
-          Address = "0.0.0.0";
-          Port = 4533;
-          DataFolder = config.modules.services.navidrome.dataDir;
-          MusicFolder = config.modules.services.navidrome.libraryDir;
-          EnableSharing = true;
+      systemd.services.navidrome = {
+        description = "Navidrome media server";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "simple";
+          User = "navidrome";
+          Group = "storage";
+          WorkingDirectory = config.modules.services.navidrome.dataDir;
+          StateDirectory = "navidrome";
+          RuntimeDirectory = "navidrome";
+          RuntimeDirectoryMode = "0700";
+          LoadCredential = [
+            "lastfm-api-key:${config.modules.services.navidrome.lastfmApiKeyFile}"
+            "lastfm-secret:${config.modules.services.navidrome.lastfmSecretFile}"
+          ];
+          ExecStartPre = configScript;
+          ExecStart = "${lib.getExe pkgs.navidrome} --configfile /run/navidrome/navidrome.toml";
+          Restart = "on-failure";
+          NoNewPrivileges = true;
+          PrivateTmp = true;
         };
       };
 
-      systemd.services.navidrome.serviceConfig = {
-        ExecStartPre = writeEnvironmentFile;
-        LoadCredential = [
-          "lastfm-api-key:${config.modules.services.navidrome.lastfmApiKeyFile}"
-          "lastfm-secret:${config.modules.services.navidrome.lastfmSecretFile}"
-        ];
-      };
+      networking.firewall.allowedTCPPorts = [ 4533 ];
     })
   ];
 }