diff --git a/Makefile b/Makefile
index a1a61ea..ddf3315 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ help:
 	@echo "NixOS Infrastructure Management"
 	@echo ""
 	@echo "Targets:"
-	@echo "  make deploy                    Deploy to both gateway and fileserver"
+	@echo "  make deploy                    Deploy to gateway and fileserver"
 	@echo "  make deploy-gateway            Deploy to gateway only"
 	@echo "  make deploy-fileserver         Deploy to fileserver only"
 	@echo "  make deploy-k8s-server         Deploy to k8s-server only"
@@ -25,7 +25,7 @@ help:
 	@echo ""
 
 # Deployment targets
-deploy: deploy-gateway deploy-fileserver deploy-k8s-server
+deploy: deploy-gateway deploy-fileserver
 
 deploy-k8s-server:
 	@echo "======================================"
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index 95b6f09..0000000
--- a/flake.lock
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1762756533,
-        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
index f1b9f66..f2732bd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Home infra for lindenfelser.de (fileserver + gateway)";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
   outputs = { self, nixpkgs, ... }:
diff --git a/modules/common.nix b/modules/common.nix
index c39cace..ecc1369 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -26,9 +26,9 @@
   users.users.danlin = {
     isNormalUser = true;
     extraGroups = [ "wheel" ];
-    initialPassword = "changeme";
+    hashedPassword = "$6$tvQ8UVAZIOm4g8PI$u1HBwK1xVINiNFOm.MtbvGsXb8R5SvBHqdJpTLcvDHJcdWa4GcB/R3txARlu.s/bLhtnwoKSKUksQ5ETwyQ5u.";
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+xf0lrobmWxml003CyjzEEZqUf2qbEv6vEGMGNUBAX danlin@MacBook-Pro-von-Daniel.fritz.box"
     ];
   };
 
diff --git a/modules/fileserver.nix b/modules/fileserver.nix
index 747c663..2ca1579 100644
--- a/modules/fileserver.nix
+++ b/modules/fileserver.nix
@@ -147,6 +147,9 @@
     "d /data/backup 0775 root root -"
     "d /data/backup/timemachine 0775 danlin users -"
     
+    # Secrets
+    "d /data/secrets 0700 root root -"
+
     # dj-beets project
     "d /opt/dj-beets 0755 root root -"
   ];
@@ -165,8 +168,8 @@
     volumes = [ "/data:/srv" ];
     environment = {
       TZ = "Europe/Berlin";
-      FILEBROWSER_ADMIN_PASSWORD = "CHANGE_ME";
     };
+    environmentFiles = [ "/data/secrets/filebrowser.env" ];
   };
 
   virtualisation.oci-containers.containers.gitea = {