diff --git a/configs/nixos/guests/navidrome.nix b/configs/nixos/guests/navidrome.nix
index 61cace4..63771e1 100644
--- a/configs/nixos/guests/navidrome.nix
+++ b/configs/nixos/guests/navidrome.nix
@@ -5,6 +5,8 @@
 }:
 let
   cfg = config.guests.navidrome;
+  envFile = "/run/secrets/navidrome.env";
+  hasLastfmSecrets = cfg.lastfmApiKeySecret != null && cfg.lastfmSecretSecret != null;
 in
 {
   options.guests.navidrome = {
@@ -52,10 +54,16 @@ in
       description = "Additional non-secret Navidrome settings.";
     };
 
-    environmentFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      description = "Guest path to a file containing secret Navidrome environment variables.";
+    lastfmApiKeySecret = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "services/navidrome/lastfm/api-key";
+      description = "SOPS secret name containing the Navidrome Last.fm API key.";
+    };
+
+    lastfmSecretSecret = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "services/navidrome/lastfm/secret";
+      description = "SOPS secret name containing the Navidrome Last.fm secret.";
     };
   };
 
@@ -80,24 +88,31 @@ in
           port
           enableSharing
           settings
-          environmentFile
           ;
+        environmentFile = if hasLastfmSecrets then envFile else null;
       };
 
-      mounts = {
-        ${cfg.dataDir} = {
-          directory = cfg.dataPath;
-          owner = config.registry."stable-uid".${config.networking.hostName}.navidrome;
-          group = "storage";
-          mode = "0770";
+      mounts =
+        {
+          ${cfg.dataDir} = {
+            directory = cfg.dataPath;
+            owner = config.registry."stable-uid".${config.networking.hostName}.navidrome;
+            group = "storage";
+            mode = "0770";
+          };
+          ${cfg.musicDir} = {
+            directory = cfg.musicPath;
+            owner = "root";
+            group = "storage";
+            mode = "2770";
+          };
+        }
+        // lib.optionalAttrs hasLastfmSecrets {
+          ${envFile} = {
+            file = config.sops.templates."navidrome.env".path;
+            readOnly = true;
+          };
         };
-        ${cfg.musicDir} = {
-          directory = cfg.musicPath;
-          owner = "root";
-          group = "storage";
-          mode = "2770";
-        };
-      };
 
       limits = {
         memory = lib.mkDefault "2G";
@@ -105,5 +120,20 @@ in
         tasksMax = lib.mkDefault 512;
       };
     };
+
+    sops.secrets = lib.optionalAttrs hasLastfmSecrets {
+      ${cfg.lastfmApiKeySecret} = { };
+      ${cfg.lastfmSecretSecret} = { };
+    };
+
+    sops.templates."navidrome.env" = lib.mkIf hasLastfmSecrets {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+      content = ''
+        ND_LASTFM_APIKEY=${config.sops.placeholder.${cfg.lastfmApiKeySecret}}
+        ND_LASTFM_SECRET=${config.sops.placeholder.${cfg.lastfmSecretSecret}}
+      '';
+    };
   };
 }
diff --git a/configs/nixos/guests/reverse-proxy.nix b/configs/nixos/guests/reverse-proxy.nix
index 27eb287..10e378e 100644
--- a/configs/nixos/guests/reverse-proxy.nix
+++ b/configs/nixos/guests/reverse-proxy.nix
@@ -23,11 +23,6 @@ in
             enableACME = true;
             locations."/".proxyPass = "http://10.23.20.32";
           };
-          "music.alexion.dev" = {
-            forceSSL = true;
-            enableACME = true;
-            locations."/".proxyPass = "http://10.23.20.32";
-          };
           "photos.alexion.dev" = {
             forceSSL = true;
             enableACME = true;
diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix
index 87da021..9aaa44c 100644
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -120,6 +120,22 @@
     };
   };
 
+  guests.navidrome = {
+    enable = true;
+    vlan = 20;
+    mac = "BC:24:11:C9:17:83";
+    dataPath = "/pikachu/data/navidrome";
+    musicPath = "/pikachu/media/music";
+    address = "10.23.20.43";
+    reverseProxy = {
+      enable = true;
+      route = {
+        domain = "music.alexion.dev";
+        port = 4533;
+      };
+    };
+  };
+
   guests.reverse-proxy = {
     enable = true;
     vlan = 20;