diff --git a/services/lldap.nix b/services/lldap.nix
index 31161fd..d84cfa3 100644
--- a/services/lldap.nix
+++ b/services/lldap.nix
@@ -1,7 +1,11 @@
 {config, ...}: let
   lldapPort = 8089;
 in {
-  age.secrets."hidden_service/lldap".file = ../secrets/hidden_service/lldap;
+  age.secrets = {
+    "hidden_service/lldap".file = ../secrets/hidden_service/lldap;
+    "lldap_root_pass".file = ../secrets/lldap_root_pass;
+  }
+  
 
   services.lldap = {
     enable = true;
@@ -11,7 +15,8 @@ in {
       ldap_user_email = "root@distrust.network";
       ldap_user_dn = "root";
       ldap_base_dn = "dc=distrust,dc=network";
-      ldap_user_pass = "VERY_SECURE";
+      ldap_user_pass_file = config.age.secrets."lldap_root_pass".path;
+      force_ldap_user_pass_reset = true;
     };
   };