diff --git a/hosts/poseidon/default.nix b/hosts/poseidon/default.nix
index 282e26d..4ad98ac 100644
--- a/hosts/poseidon/default.nix
+++ b/hosts/poseidon/default.nix
@@ -117,6 +117,7 @@ in
 
     nextcloud = {
       enable = true;
+      adminpassFile = config.age.secrets."nextcloud/admin-pass".path;
     };
 
     nuage = {
diff --git a/hosts/poseidon/secrets.nix b/hosts/poseidon/secrets.nix
index f058804..24785d6 100644
--- a/hosts/poseidon/secrets.nix
+++ b/hosts/poseidon/secrets.nix
@@ -17,6 +17,10 @@
             owner = "matrix-synapse";
           };
 
+          "nextcloud/admin-pass" = {
+            owner = "nextcloud";
+          };
+
           "restic-backup/poseidon-credentials" = {};
           "restic-backup/poseidon-password" = {};
 
diff --git a/modules/secrets/nextcloud/admin-pass.age b/modules/secrets/nextcloud/admin-pass.age
new file mode 100644
index 0000000..e2c436e
Binary files /dev/null and b/modules/secrets/nextcloud/admin-pass.age differ
diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
index 4516497..e8215c1 100644
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@@ -17,6 +17,8 @@ in
 
   "matrix-synapse/secret-config.age".publicKeys = [ poseidon ];
 
+  "nextcloud/admin-pass.age".publicKeys = [ poseidon ];
+
   "restic-backup/boreal-password.age".publicKeys = [ alarsyo boreal ];
   "restic-backup/boreal-credentials.age".publicKeys = [ alarsyo boreal ];
   "restic-backup/poseidon-password.age".publicKeys = [ alarsyo poseidon ];
diff --git a/secrets/default.nix b/secrets/default.nix
index 726354d..d514361 100644
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -11,8 +11,6 @@ in {
 
   config.my.secrets = {
     miniflux-admin-credentials = fileContents ./miniflux-admin-credentials.secret;
-    nextcloud-admin-pass = ./nextcloud-admin-pass.secret;
-    nextcloud-admin-user = fileContents ./nextcloud-admin-user.secret;
 
     paperless = import ./paperless { inherit lib; };
   };
diff --git a/secrets/nextcloud-admin-pass.secret b/secrets/nextcloud-admin-pass.secret
deleted file mode 100644
index 49f51ea..0000000
Binary files a/secrets/nextcloud-admin-pass.secret and /dev/null differ
diff --git a/secrets/nextcloud-admin-user.secret b/secrets/nextcloud-admin-user.secret
deleted file mode 100644
index e653faf..0000000
Binary files a/secrets/nextcloud-admin-user.secret and /dev/null differ
diff --git a/services/nextcloud.nix b/services/nextcloud.nix
index 89a6bf5..909bd95 100644
--- a/services/nextcloud.nix
+++ b/services/nextcloud.nix
@@ -6,6 +6,7 @@ let
   inherit (lib)
     mkEnableOption
     mkIf
+    mkOption
   ;
 
   cfg = config.my.services.nextcloud;
@@ -14,8 +15,16 @@ let
   dbName = "nextcloud";
 in
 {
-  options.my.services.nextcloud = {
+  options.my.services.nextcloud = let inherit (lib) types; in {
     enable = mkEnableOption "NextCloud";
+
+    adminpassFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to a file containing the admin's password, must be readable by
+        'nextcloud' user.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -62,8 +71,8 @@ in
         dbname = dbName;
         dbhost = "/run/postgresql";
 
-        adminuser = my.secrets.nextcloud-admin-user;
-        adminpassFile = "${my.secrets.nextcloud-admin-pass}";
+        adminuser = "admin";
+        adminpassFile = cfg.adminpassFile;
       };
     };