diff --git a/configs/nixos/guests/navidrome.nix b/configs/nixos/guests/navidrome.nix
index 78f70d6..fcbe928 100644
--- a/configs/nixos/guests/navidrome.nix
+++ b/configs/nixos/guests/navidrome.nix
@@ -5,6 +5,9 @@
 }:
 let
   serviceConfig = config.containers.navidrome.config.modules.services.navidrome;
+  lastfmApiKeySecret = "services/navidrome/lastfm/api-key";
+  lastfmSecretSecret = "services/navidrome/lastfm/secret";
+  hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
 in
 {
   options.guests.navidrome = {
@@ -51,6 +54,10 @@ in
           group = "storage";
           mode = "2770";
         };
+        ${serviceConfig.environmentFile} = {
+          file = config.sops.templates."navidrome.env".path;
+          readOnly = true;
+        };
       };
 
       limits = {
@@ -60,5 +67,19 @@ in
       };
     };
 
+    sops.secrets = {
+      ${lastfmApiKeySecret}.sopsFile = hostSecrets;
+      ${lastfmSecretSecret}.sopsFile = hostSecrets;
+    };
+
+    sops.templates."navidrome.env" = {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+      content = ''
+        ND_LASTFM_APIKEY=${config.sops.placeholder.${lastfmApiKeySecret}}
+        ND_LASTFM_SECRET=${config.sops.placeholder.${lastfmSecretSecret}}
+      '';
+    };
   };
 }
diff --git a/configs/nixos/modules/services/navidrome.nix b/configs/nixos/modules/services/navidrome.nix
index 78265ce..ab1d5cd 100644
--- a/configs/nixos/modules/services/navidrome.nix
+++ b/configs/nixos/modules/services/navidrome.nix
@@ -23,6 +23,13 @@ in
       readOnly = true;
       description = "Guest path for Navidrome's `MusicFolder` setting.";
     };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/run/secrets/navidrome.env";
+      readOnly = true;
+      description = "Guest path for Navidrome's environment file.";
+    };
   };
 
   config = lib.mkMerge [
@@ -43,6 +50,7 @@ in
         user = "navidrome";
         group = "storage";
         openFirewall = true;
+        environmentFile = cfg.environmentFile;
         settings = {
           Address = "0.0.0.0";
           Port = 4533;