diff --git a/modules/common/keycloak.nix b/modules/common/keycloak.nix
index 30e078b..e158825 100644
--- a/modules/common/keycloak.nix
+++ b/modules/common/keycloak.nix
@@ -1,4 +1,21 @@
-{ config, ... }: {
+{ config, lib, ... }: {
+  sops.secrets.keycloak_rsa_private_key = {
+    mode = "0600";
+    owner = "keycloak";
+    group = "keycloak";
+    sopsFile = ../../secrets/keycloak_rsa_private_key.pem;
+    format = "binary";
+  };
+
+  users.users.keycloak = {
+    isSystemUser = true;
+    createHome = true;
+    home = "/var/keycloak";
+    group = "keycloak";
+  };
+  users.groups.keycloak = {};
+  systemd.services.keycloak.serviceConfig.DynamicUser = lib.mkForce false;
+
   services.keycloak = {
     enable = true;
     settings = {
@@ -13,9 +30,8 @@
       hostname = "login.clicks.codes";
       hostname-strict = false;
 
-      https-certificate-file = "/var/keycloak/login.clicks.codes.rsa.cert.pem";
-      https-certificate-key-file =
-        "/var/keycloak/login.clicks.codes.rsa.private.pem";
+      https-certificate-file = "${./keycloak/login.clicks.codes.rsa.cert.pem}";
+      https-certificate-key-file = config.sops.secrets.keycloak_rsa_private_key.path;
     };
     database = {
       createLocally = false;
@@ -23,4 +39,5 @@
       passwordFile = config.sops.secrets.clicks_keycloak_db_password.path;
     };
   };
+  
 }