diff --git a/machines/serverle/secrets.yaml b/machines/serverle/secrets.yaml
index 8267d28..c93212f 100644
--- a/machines/serverle/secrets.yaml
+++ b/machines/serverle/secrets.yaml
@@ -24,6 +24,8 @@ sonarr:
     apikey: ENC[AES256_GCM,data:gnqWrd3FAqR49Q3LJfVk0DtSa9Oo5qR8BguI7qhF62Q=,iv:mmSHSV74EHtsor3xBU5HL7DtVXk3SKu5KjV2DglWgNI=,tag:1jlDMaYp2zu4B1EpfeL9nQ==,type:str]
 prowlarr:
     apikey: ENC[AES256_GCM,data:5H3aZEaa7trPgwo7CKnryhMUdZ+UP+a9UBNbeLNHqxk=,iv:OE5/q4HRIhoB/ZK4ic2nC63t5nNyJi2AZsP4JYuxaW0=,tag:l5IFkGCmam+f3dFgKM1Rwg==,type:str]
+bazarr:
+    apikey: ENC[AES256_GCM,data:242MsUAen1TWp967NoWifjuof41umtrpTKDRe2eeLyU=,iv:uvWaZmatQk71Q1Q7TQ4PLmjn1jYwKrrWLZ+xOjgl6eo=,tag:BFYP4uozPyAX9I8djfBESQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -48,8 +50,8 @@ sops:
             a1BjcjVaM01UV0o5bTFTVTE5QUZKMmsKPAGYDf1FVtp4+Z/KUrI6z0aZYEwN1DYa
             jKtA1IUXrmdaRllN0SfC+YjMXTk7IoJvrjagCv9Zo0zEKasfO8PL4g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-11-13T22:36:19Z"
-    mac: ENC[AES256_GCM,data:jmclk98sHpnrO4Nj/ZiG+3gVmG6UvoClZR/FPYFgaBpJBk/W1zXXuH+wAb+dh3M5H3x030QFbNj/3006JZIlBCkarRggvJ1vQvC8XKlIFyTnGeY+1gXER/ssj22y/0RkF2HpOr68Sg51edcL5hiHtfAokxMuiouUkdRxV3KK3lY=,iv:FAdXDOw1r718fogIfFyzYplyFp/kmL9VHvO+RFyMPuM=,tag:HlZPTyZpmrvzT6pCgWLW9Q==,type:str]
+    lastmodified: "2023-11-30T22:21:06Z"
+    mac: ENC[AES256_GCM,data:dE8vOMrTNE8IJRzyIVkLgwr6RWfnz6RNVhX6hSWNuEX+Jz2n2gp6dxU1sOveQzXE8cuVdNyIsKTrD2nAAbLVDgFFRfm9Bka7V1YCNGO1sRqlcwaNPourHCCBTtwSMdzp5qSjOyrx/Bja8gyfM5q6q9Y9rA5Rr2Yzp4G4HHrsBvY=,iv:pjpehd4jbsT/9QyfOkKAL73p3lbv3EzvOovdJ0y2XP0=,tag:6B5kDTBWV7yqnqeB5TB6lw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1
diff --git a/machines/serverle/services.nix b/machines/serverle/services.nix
index 742819f..be8f062 100644
--- a/machines/serverle/services.nix
+++ b/machines/serverle/services.nix
@@ -6,15 +6,16 @@ in
 {
   sops.secrets = {
     "acme/inwx" = { };
+    "bazarr/apikey" = { };
     "borgbackup/password" = { };
     "borgbackup/ssh_key" = { };
     "dyndns/password" = { };
-    "sso/auth-key" = { };
-    "sso/felix/password-hash" = { };
-    "sso/felix/totp-secret" = { };
     "prowlarr/apikey" = { };
     "radarr/apikey" = { };
     "sonarr/apikey" = { };
+    "sso/auth-key" = { };
+    "sso/felix/password-hash" = { };
+    "sso/felix/totp-secret" = { };
   };
 
   # List services that you want to enable:
@@ -59,6 +60,7 @@ in
     };
     bazarr = {
       enable = true;
+      apiKeyFile = secrets."bazarr/apikey".path;
     };
 
     ssh-server = {