diff --git a/modules/nixos/zulip.nix b/modules/nixos/zulip.nix
index 3c4bb13..4fe7984 100644
--- a/modules/nixos/zulip.nix
+++ b/modules/nixos/zulip.nix
@@ -14,6 +14,9 @@
     secretKeyFile = builtins.toString config.age.secrets.zulip-secretKey.path;
     sharedSecretKeyFile = builtins.toString config.age.secrets.zulip-sharedSecretKey.path;
     avatarSaltKeyFile = builtins.toString config.age.secrets.zulip-avatarSaltKey.path;
+    extraSecrets = {
+      email_password = builtins.toString config.age.secrets."mailserver-acc-admin-pw".path;
+    };
 
     # settings
     zulipSettings = {
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 62ec92a..62a39fa 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,11 +4,16 @@ let
   lenovo = pub-keys.ssh.lenovo;
   _109-199-104-83 = pub-keys.ssh._109-199-104-83;
 in {
+  # user passwords
   "andromeda-pw.age".publicKeys = [andromeda lenovo];
   "mtgmonkey-pw.age".publicKeys = [andromeda lenovo];
+
+  # mail account passwords
   "mailserver-acc-test-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
   "mailserver-acc-admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
   "mailserver-acc-zulip+admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip keys
   "zulip-avatarSaltKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
   "zulip-camoKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
   "zulip-rabbitmqPassword.age".publicKeys = [andromeda lenovo _109-199-104-83];