diff --git a/nixos/modules/services/web-apps/isso.nix b/nixos/modules/services/web-apps/isso.nix
index 87804b7ea7cf..97076eaba37c 100644
--- a/nixos/modules/services/web-apps/isso.nix
+++ b/nixos/modules/services/web-apps/isso.nix
@@ -37,6 +37,8 @@ in
 
           See [Isso Server Configuration](https://posativ.org/isso/docs/configuration/server/)
           for supported values.
+          You can set secrets using the secretFile option with environment variables following
+          [the documentation](https://isso-comments.de/docs/reference/server-config/#environment-variables).
         '';
 
         type = types.submodule {
@@ -51,6 +53,16 @@ in
           }
         '';
       };
+
+      secretFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          A file containing secrets as environment variables that will be used in the configuration.
+          See [the documentation](https://isso-comments.de/docs/reference/server-config/#environment-variables) for details.
+        '';
+        example = "/run/secrets/isso.env";
+      };
     };
   };
 
@@ -65,6 +77,8 @@ in
         User = "isso";
         Group = "isso";
 
+        EnvironmentFile = mkIf (cfg.secretFile != null) [ cfg.secretFile ];
+
         DynamicUser = true;
 
         StateDirectory = "isso";