diff --git a/hosts/sakura/services/traefik.nix b/hosts/sakura/services/traefik.nix
index 298a3bc..10dc138 100644
--- a/hosts/sakura/services/traefik.nix
+++ b/hosts/sakura/services/traefik.nix
@@ -1,10 +1,13 @@
-_: {
+{config, ...}: {
   sops.secrets.cloudflare-api-key = {};
   networking.firewall.allowedTCPPorts = [80 443];
   systemd.services.traefik = {
     environment = {
       CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev";
     };
+    serviceConfig = {
+      EnvironmentFile = [config.sops.secrets.cloudflare-api-key.path];
+    };
   };
   services.traefik = {
     enable = true;