diff --git a/modules/system/label-studio.nix b/modules/system/label-studio.nix
index fdeed15..57dc9e6 100644
--- a/modules/system/label-studio.nix
+++ b/modules/system/label-studio.nix
@@ -12,13 +12,21 @@ with lib;
 				name = "label-studio";
 			}];
 		};
+		sops.secrets.label-studio-env = {
+			format = "dotenv";
+			group = "label-studio";
+			mode = "0440";
+			owner = "label-studio";
+			restartUnits = ["podman-label-studio.service"];
+			sopsFile = ../../secrets/label-studio.env;
+		};
 		systemd.tmpfiles.rules = [
 			"d /mnt/bigdisk/label-studio 0755 label-studio label-studio"
 		];
 		virtualisation.oci-containers.containers.label-studio = {
-			#environmentFiles = [
-				#"/var/run/secrets/rag-api-env"
-			#];
+			environmentFiles = [
+				"/var/run/secrets/label-studio-env"
+			];
 			extraOptions = [
 				"--userns=keep-id:uid=1001,gid=0"
 			];
diff --git a/secrets/label-studio.env b/secrets/label-studio.env
new file mode 100644
index 0000000..25260f3
--- /dev/null
+++ b/secrets/label-studio.env
@@ -0,0 +1,22 @@
+DJANGO_DB=ENC[AES256_GCM,data:5p2whEaP0g==,iv:IDLzn0xPKr63sd5wThrSIvqTWtcjkdc3iGje9HEb++I=,tag:pfGm8XSkufXEbewM5vtzTQ==,type:str]
+POSTGRE_NAME=ENC[AES256_GCM,data:/wWte4TeVcdXOvnr,iv:3PuvF5pxB5uQNGIOXXD1W+W0o0juWGBjQgy+dRbPUes=,tag:4ubNBGK+dXpGQKznfHvThA==,type:str]
+POSTGRE_USER=ENC[AES256_GCM,data:LP53XnRnWw+oZ89v,iv:wWXhT7aES7G/HDIWEj9Pr7rXVhJMOeZHXznOELwIky8=,tag:iKgc09fO0d7fpoU5uZQocA==,type:str]
+POSTGRE_PASSWORD=
+POSTGRE_PORT=ENC[AES256_GCM,data:QYIANQ==,iv:AAvgTBLZ6rSnyo3of4PS4TKyIigsqiacEgsoswSCBvY=,tag:6yPCo8vUWHMU8P4CC86I2g==,type:str]
+POSTGRE_HOST=ENC[AES256_GCM,data:lnqp/CVqL80QWU1s1Z3S,iv:rvx0cDQdjPd3DxePvNBsMVeJcFGwwKew4pIHtkIFeSw=,tag:fcOv++6Dr2StC8LgqnmyBA==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkUXlUYkF1NmkzOEIzR0lJ\nRklXZGx3c1lpbjRkYkJXRjIwamtwU3hOUGhFCkJ1SnYxek9qVzA0RC95dGxwVjg0\nWDY3RlExWFZpWEUzTGdsT1JOeUxoN2cKLS0tIDdsWHZmVy94RVR2NWhRYjc1RWFu\nd1J4UkxsODVXd0F5cG43NlRPRmlXSFUKLzbLUI1xkY/mIf6AwjPiyZjsh/tdt1hr\n6ckHmwP2a2kWId5OxLSc+LbPOhlpFbPAJUHaEar1vvAkNpnH+/jgLA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1fnkhk9rv7r8gh84vxnhvndk4fgh20qcj4hvnfhdpumcydl6m6vrse50lrz
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmV24yb3NnYW1TeUdrdU1i\na1k5RHd3MkFQeHA4eURudVZkbEZSd2RYWUdzCjYxVjBraTFPUVRDc2IzSFdqN3NC\naERqbTZEQmFGQ1VhbXBWRVhWeG9TczQKLS0tIDZZVEtIU210ZldzSnpxNzNrbXRP\najBSaitoejVOMHhkUGlGSnlCS01tN1kKja04tl4il7cbnohzlhxqOjy6bI5gWKvi\nIOIEJR611q1WCEbbrYwhZgEnN/KBAwaPLRJqqT9CEPu9TV/4Op/I1g==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1x704pjnueguchkl54ly8w4w26ltys5900v7xnl7w3zlgasus09jszz45t8
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNY01ybldRRUpleXJzcEtG\ncWd4UXhJb3FJanZveHFQaVhJc2NxU0R4VmdjCjFEWUpaUHRGZGxsK3FIVm9Kb1JT\nNE5RSFFkNkpVcDYzUWlxekQ1N1BFbGMKLS0tIGZmaWY3ejB6VE1ZK1NXL1hzVjBD\nQTl0eU1MRjlGQi9FOXlrTHpLTjdnL2MKDvW60ftQmvBm7nBCDPP24MrzoG+E3VNb\nsNsX6W9qtlgVwjSwrTqdqQtGWy65fLSgo/lWg8zM1OJkoPVIuvU/bA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age15y4k929zaj9fdg3vd40pa40tgvrgv9mn22xfummn5zxfmkcw5d0st6prjx
+sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBScENkT1BTQVFmakxWM3JD\nazVNcm9nZWcvVE1MbFVHeGpyZGZFajdTWHhNCkMzb1lheVFNakFnZ08rNWhHNll5\nTzgybDJ3bXNkWTl3RjhLUE9PU2hBUmMKLS0tIDdEMFh6MTM1OTdOOE5GLy83bS9v\nY3dXRzRqUFRWWFIrNGcrRDc2WDNGakUKMAImuTBV4gIl8W7umBoNLsbiBREh9TAe\nUkg94LdnFvc7ytXDouXy2uy4Xs1zN/p1k33c8WJkUArbHPc3PB1bXA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_3__map_recipient=age1ck44jqpuz3zlthquvuh7wsemrjrgfzhn462sk7rlfetwxpgy0uqs79xn2h
+sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bjN6OG5QcVQ0UVlNNEpr\ncG1lYlNPaGhXVS9Yd0F6cXRrK0dYeW5oS1NNCjdPQmRJRHl4TFcvVXE2c2Z2cERy\ndm8reWdweEVXK0t0b3ZLdTVjcXdZVXMKLS0tIEh5czUveXVoZUpJU3NyQzRmS2NR\nb1Yvc0J0TTJmQmhPZXhUMFRNTUJydE0KvrE1rAFkQCXRolvkCFf3ffiGTAqIWVmT\nDr9ISp5FsWhlLCo+oJNMxp7AEnwfP2+CEVnsO/jvNKDThJuenmHy6g==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_4__map_recipient=age1t3ryfktuhr3cysf49m9q2n8fkjf9ajjjnhztxw9hz8paxgk4lpcq065jge
+sops_age__list_5__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5cGJzeU51NjIzWXdCd3Fu\nZmlTVXlzQzVCUXVhRFZ1czkrRHpGbVRmRFE0Ci9HL3JKbnEwQWdRTDVObGh3UllD\ncXJuYkhkOFVyTithV3kyOUxKOFJHTVUKLS0tIE50ZzdEU3h1eXBrb1VMUHliYlBq\nK2hGTFFDS051MUp4c0JRaHB1YStjTncKAyVBB3UTdhguN7Nm7cfTN3E3aaInBi0y\nNdnp+ntwHSwdBKYvChA0eCR+32WjaW3Kfifj0wW3X/0Uh2RqGCsX8g==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_5__map_recipient=age1j90h7hcp4fctr2xwj4zf9cxuelm43wkujvryc9hk6rzzc37rwdmss035w7
+sops_lastmodified=2025-10-01T18:11:58Z
+sops_mac=ENC[AES256_GCM,data:WOjhvA32tdUrpT1ebMnY855bxfCHp5Npawapv/K1ONWN5oBocDewZ3OjxKCoZMped9lsUMfqN6DfUH9JCTGcBFxKEaNIPMMY2RpDD6oMe2h0Pu8rAD7FvDBYvrkFS1uhlrfhKD62CKdbHyUZmMrh8TinVpRA3mMah8AjjdW8cF8=,iv:gh+//1P50CW46sJjS3u65C5Nx6V8YSkBdM/ycqlwHuc=,tag:EYpBfElcbNVUF2oE0s40Cw==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.10.2