diff --git a/hosts/hitsugibune/matrix.nix b/hosts/hitsugibune/matrix.nix
index 99b5b6b..7b6c45a 100644
--- a/hosts/hitsugibune/matrix.nix
+++ b/hosts/hitsugibune/matrix.nix
@@ -10,6 +10,12 @@ let
     return 200 '${builtins.toJSON data}';
   '';
 in {
+  age.secrets.matrix = {
+    file = ../../secrets/matrix.age;
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+  };
+
   networking.domain = "sprechtl.me";
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
@@ -69,6 +75,7 @@ in {
     # from the value of `fqdn` above, you will likely run into some mismatched domain names
     # in client applications.
     settings.public_baseurl = baseUrl;
+    settings.enable_registration = true;
     settings.listeners = [
       { port = 8008;
         bind_addresses = [ "::1" ];
@@ -81,5 +88,6 @@ in {
         } ];
       }
     ];
+    extraConfigFiles = [ config.age.secrets.matrix.path ];
   };
 }
diff --git a/secrets/matrix.age b/secrets/matrix.age
new file mode 100644
index 0000000..1fbfed1
--- /dev/null
+++ b/secrets/matrix.age
@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-ed25519 7PLkJg WDFC+mhq1R/cg+akT6cLXXs9MHP5gJECaD8nXh/nISQ
+eC80R+CqNYVXaTcwi+20DXf+u8oR5GDpjvbvOHxzRbY
+-> ssh-rsa LgF3EQ
+WIyTE1SHErO8caYtYFRRmrvg7i4ZNRHXIsSyd62JNsXEcSQynyHtSo1eiI6VzSdG
+dGiRMrF/SOam0OHMWs+1O3f/GBT+Uk76IeXMgYAdpX05PDlmo/JibgRf2O5Joqpw
+oBgSkfTjKtwALUdILb/sXn54qVSxVhzcSZQdTiA/HpAYWMgxZnZKvQqKhjZan6C/
+A65M+yFjha/QWJ2MMIVnQyE2mktmHSXpg9hzdC+GcpyZOsxFvRP0pOxqzHWd6eRx
+Mrzgk3oiYj41CuILHSacgJ5GN5Dxwqn4a7k0m1ishSbeWnKe1nurhL8HMtqJ5bKD
+zlHHyBsZtkQuXAh7Dn+slX8+lvfEbZdMZoON7Wn4nGsJWido3pvnHKSAUsBkTL28
+7ULHlVH3m0gb9ELcRXcT6dVc0Kcdq8SFWzFx0eImv7DDp/xSBwyJfhzFgHEjPXQr
+1OAPeTAVxFKvUmZNWosRYtSPN0yJoGzuXG07P3zL4xS8LmjImxLBZRIxNlDXQkcg
+
+--- Uwzih4YPNY9s+j12ZEl5PL9jGoK9kt00f/UqW594mV4
+Ǐ�u$��X8�…�M
+X�̑���͞����%I�J`������Ws�)[Q0�"��x0L��G#�ٛ��G���G��W��)��ױ��t摔��m
�T
v͵�K ��O�o["S΁y��2��
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index e0231ac..50dc42c 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -6,4 +6,5 @@ in {
   "nextcloud.age".publicKeys = [hitsugibune key];
   "onlyoffice.age".publicKeys = [hitsugibune key];
   "speedtest-tracker.age".publicKeys = [saberofxebec key];
+  "matrix.age".publicKeys = [hitsugibune key];
 }