diff --git a/hosts/thrall/default.nix b/hosts/thrall/default.nix
index ce11aa8..ec2adbe 100644
--- a/hosts/thrall/default.nix
+++ b/hosts/thrall/default.nix
@@ -36,6 +36,7 @@ in {
 
   age.secrets = {
     mailPass.file = ../../secrets/mailPass.age;
+    paperless-mail.file = ../../secrets/paperless-mail.age;
     wireguard-thrall.file = ../../secrets/wireguard-thrall.age;
   };
 
@@ -312,6 +313,10 @@ in {
 
         catchAll = [ "jakalx.net" ];
       };
+
+      "archive@failco.de" = {
+        hashedPasswordFile = config.age.secrets.paperless-mail.path;
+      };
     };
 
     certificateScheme = 3;
diff --git a/secrets/paperless-mail.age b/secrets/paperless-mail.age
new file mode 100644
index 0000000..ae80b74
Binary files /dev/null and b/secrets/paperless-mail.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 0d7b55f..794f07e 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,10 +1,12 @@
 let
   thrall = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHNRSYszckbCwKoX/cci8D40DGM/SG/NJ/u/uB361re";
+  alex = "age13uv5phqjuvd90rr3aa7mg3xsmcmyx8cfz9v52w2a782qecssja9sw9nt8a";
   systems = [ thrall ];
 
-  users = [];
+  users = [ alex ];
 in
 {
   "mailPass.age".publicKeys = users ++ systems;
+  "paperless-mail.age".publicKeys = users ++ systems;
   "wireguard-thrall.age".publicKeys = [thrall];
 }