diff --git a/nixos/modules/services/home-automation/esphome.nix b/nixos/modules/services/home-automation/esphome.nix
index 7a66b8ec19f2..7dc8de0f531e 100644
--- a/nixos/modules/services/home-automation/esphome.nix
+++ b/nixos/modules/services/home-automation/esphome.nix
@@ -17,7 +17,7 @@ let
 
   cfg = config.services.esphome;
 
-  stateDir = "/var/lib/esphome";
+  stateDir = "esphome";
 
   esphomeParams =
     if cfg.enableUnixSocket then
@@ -79,6 +79,28 @@ in
       type = types.bool;
       description = "Use ping to check online status of devices instead of mDNS";
     };
+
+    environment = mkOption {
+      default = { };
+      type = types.attrsOf types.str;
+      description = ''
+        Extra environment variables to pass to ESPHome. Secrets should be passed
+        using the {option}`services.esphome.environmentFile` option.
+      '';
+      example = {
+        USERNAME = "reimu";
+        PASSWORD = "gensokyo9";
+      };
+    };
+
+    environmentFile = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = ''
+        Path to an environment file.
+        Use this option for setting the dashboard password.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -92,21 +114,25 @@ in
 
       environment = {
         # platformio fails to determine the home directory when using DynamicUser
-        PLATFORMIO_CORE_DIR = "${stateDir}/.platformio";
+        PLATFORMIO_CORE_DIR = "%S/${stateDir}/.platformio";
       }
-      // lib.optionalAttrs cfg.usePing { ESPHOME_DASHBOARD_USE_PING = "true"; };
+      // lib.optionalAttrs cfg.usePing { ESPHOME_DASHBOARD_USE_PING = "true"; }
+      // cfg.environment;
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/esphome dashboard ${esphomeParams} ${stateDir}";
+        ExecStart = "${cfg.package}/bin/esphome dashboard ${esphomeParams} %S/${stateDir}";
         DynamicUser = true;
         User = "esphome";
         Group = "esphome";
-        WorkingDirectory = stateDir;
+        WorkingDirectory = "%S/${stateDir}";
         StateDirectory = "esphome";
         StateDirectoryMode = "0750";
         Restart = "on-failure";
         RuntimeDirectory = mkIf cfg.enableUnixSocket "esphome";
         RuntimeDirectoryMode = "0750";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecPaths = "%S/${stateDir}";
+        ReadWritePaths = "%S/${stateDir}";
 
         # Hardening
         CapabilityBoundingSet = "";