diff --git a/.gitignore b/.gitignore
index b2be92b..87a3018 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 result
+*.qcow2
diff --git a/hosts/vm/mediakiwi/default.nix b/hosts/vm/mediakiwi/default.nix
index 09e1ac4..da91291 100644
--- a/hosts/vm/mediakiwi/default.nix
+++ b/hosts/vm/mediakiwi/default.nix
@@ -6,7 +6,7 @@
     ./networking.nix
 
     ../../../modules
-    # ../../../modules/services/mediawiki.nix
+    ../../../modules/services/mediawiki.nix
   ];
 
   networking.hostName = "mediakiwi";
diff --git a/modules/services/mediawiki.nix b/modules/services/mediawiki.nix
index bfdca9b..b3cb51a 100644
--- a/modules/services/mediawiki.nix
+++ b/modules/services/mediawiki.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 
 {
   services.mediawiki = {
@@ -16,7 +16,11 @@
       ];
     };
 
-    passwordFile = pkgs.writeText "password" "cardbotine";
+    age.secrets.mediawiki-admin-passwd = {
+      file = ../../secrets/mediakiwi/mediawiki-admin-passwd.age;
+    };
+
+    passwordFile = config.age.secrets.mediawiki-admin-passwd.path;
 
     extraConfig = ''
       # contact info
diff --git a/secrets.nix b/secrets.nix
index 09292e5..ac579c1 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -111,4 +111,5 @@ in
   "secrets/apprentix/root.age".publicKeys = [ apprentix ];
   "secrets/neo/database-extra-config.age".publicKeys = [ neo ];
   "secrets/neo/matrix-appservice-irc-password.age".publicKeys = [ neo ];
+  "secrets/mediakiwi/mediawiki-admin-passwd.age".publicKeys = [ mediakiwi ];
 }
diff --git a/secrets/mediakiwi/mediawiki-admin-passwd.age b/secrets/mediakiwi/mediawiki-admin-passwd.age
new file mode 100644
index 0000000..998f40d
--- /dev/null
+++ b/secrets/mediakiwi/mediawiki-admin-passwd.age
@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 vZ8Vgw oEYPtmVUnoOjjiYyB/k1K70aTaUc8yaFKgnftR/vRls
+20sp0o5Bi8ebZVxltOu8JAFS+7pRLZnkvI7Z46BBmtU
+-> piv-p256 ewCc3w A/amtNzHFy9pfbpYyu/PHCt0Cr5BGAUpyVb2ll3nX5VG
+wPsC1ZZOyIOhWJmT7mKrp68RlB6RgfObULJ3kAXA+f0
+-> piv-p256 6CL/Pw AiURYPR5gbbz8EW8FbcSZPL7qfLeUr6MReSFPZYRR6k6
+IOfrVsSGWmvDqW0ur8Rb0G9q98Qbc7Q9Hcw+J7twKeA
+-> ssh-ed25519 I2EdxQ cw4/OfxXByu8afEzMGNDji9TkZ7SpqjG3tFsgMw09T0
+b0qOsH70/DxhOQ2jpyeYliIql707+PacbZykqXkjCaI
+-> ssh-ed25519 J/iReg 63ftKWZoU2/CI5338/bN99Npw5rNCRtptcUdWGSVTgY
+AokJ3oTUGe9BHstt6MnwQZk3w9ONIVfkist1ZPlBGXc
+-> ssh-ed25519 GNhSGw rcUHAE36kMf2pv2dNP6oVwB8Xz1qMLANiRSNUG0bQAk
+5KhEzAAgDEwDor3xtLMuF7CSfBWCfoykROVabjpqQIc
+-> ssh-ed25519 eXMAtA 0j0xZb7QWe1YqxHKncTyoMiDR120F8k+DvvNmedeti8
+kf1DjOIO3oJrGs+0L5OmFXb0Or0HAOuEjUci3sHIidI
+--- ZxETwXAvw7vFD19/JKxp9kuIcODkoXWJW3HDKZZ93IU
+d��~S�s@���1�q-?$U�g�� ��Z'x��b���b��?�v�h=s
\ No newline at end of file