diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 157a6c6b84e3..d55658bb25b2 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -335,7 +335,23 @@ in
                       If the master is password protected (using the requirePass configuration)
                       it is possible to tell the slave to authenticate before starting the replication synchronization
                       process, otherwise the master will refuse the slave request.
-                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
+                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
+                    '';
+                  };
+
+                  masterAuthFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for the master user.";
+                    example = "/run/keys/redis-master-password";
+                  };
+
+                  masterUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = ''
+                      If the master is password protected via ACLs this option can be used to specify
+                      the Redis user that is used by replicas.'';
                   };
 
                   requirePass = lib.mkOption {
@@ -355,6 +371,43 @@ in
                     example = "/run/keys/redis-password";
                   };
 
+                  sentinelAuthPassFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for connecting to other Sentinel instances.";
+                    example = "/run/keys/sentinel-password";
+                  };
+
+                  sentinelAuthUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The username to use to monitor a master from Sentinel.";
+                  };
+
+                  sentinelMasterHost = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The IP address (recommended) or hostname of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterName = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The master name of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterPort = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The TCP port of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterQuorum = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The Sentinel quorum (minimum number of Sentinel nodes online for failover)";
+                  };
+
                   appendOnly = lib.mkOption {
                     type = types.bool;
                     default = false;
@@ -452,14 +505,55 @@ in
 
   config = lib.mkIf (enabledServers != { }) {
 
-    assertions = lib.attrValues (
-      lib.mapAttrs (name: conf: {
-        assertion = conf.requirePass != null -> conf.requirePassFile == null;
-        message = ''
-          You can only set one services.redis.servers.${name}.requirePass
-          or services.redis.servers.${name}.requirePassFile
-        '';
-      }) enabledServers
+    assertions = lib.concatLists (
+      lib.mapAttrsToList (name: conf: [
+        {
+          assertion = conf.requirePass != null -> conf.requirePassFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.requirePass
+            or services.redis.servers.${name}.requirePassFile
+          '';
+        }
+        {
+          assertion = conf.masterAuth != null -> conf.masterAuthFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.masterAuth
+            or services.redis.servers.${name}.masterAuthFile
+          '';
+        }
+        {
+          assertion = conf.masterUser != null -> (conf.masterAuth != null || conf.masterAuthFile != null);
+          message = ''
+            If using services.redis.servers.${name}.masterUser, either
+            services.redis.servers.${name}.masterAuthFile or
+            services.redis.servers.${name}.masterAuth must be provided
+          '';
+        }
+        {
+          assertion =
+            conf.sentinelMasterName != null
+            -> (
+              conf.sentinelMasterHost != null
+              && conf.sentinelMasterPort != null
+              && conf.sentinelMasterQuorum != null
+            );
+          message = ''
+            For Sentinel,
+            services.redis.servers.${name}.sentinelMasterName,
+            services.redis.servers.${name}.sentinelMasterHost,
+            services.redis.servers.${name}.sentinelMasterPort,
+            and services.redis.servers.${name}.sentinelMasterQuorum
+            must all be provided
+          '';
+        }
+        {
+          assertion = conf.sentinelAuthPassFile != null -> conf.sentinelMasterName != null;
+          message = ''
+            For Sentinel authentication, services.redis.servers.${name}.sentinelMasterName,
+            must be provided
+          '';
+        }
+      ]) enabledServers
     );
 
     boot.kernel.sysctl = lib.mkIf cfg.vmOverCommit {
@@ -498,6 +592,17 @@ in
           ExecStart = "${cfg.package}/bin/${
             cfg.package.serverBin or "redis-server"
           } /var/lib/${redisName name}/redis.conf ${lib.escapeShellArgs conf.extraParams}";
+
+          # NOTE: Redis/Valkey Sentinel persists dynamic cluster state by rewriting its
+          # configuration file at runtime (redis.conf). This includes monitors,
+          # authentication credentials, and failover metadata, and this behaviour
+          # cannot be disabled.
+          # As a result, a fully declarative configuration is not possible for
+          # Sentinel-managed options. The preStart logic below appends sentinel
+          # configuration only if it is not already present, in order to avoid
+          # overwriting state that is owned and maintained by Sentinel itself.
+          # This is an intentional deviation from strict declarative semantics and
+          # is required for correct Sentinel operation.
           ExecStartPre =
             "+"
             + pkgs.writeShellScript "${redisName name}-prep-conf" (
@@ -515,10 +620,40 @@ in
                 fi
                 echo 'include "${redisConfStore}"' > "${redisConfRun}"
                 ${lib.optionalString (conf.requirePassFile != null) ''
-                  {
-                    echo -n "requirepass "
-                    cat ${lib.escapeShellArg conf.requirePassFile}
-                  } >> "${redisConfRun}"
+                  echo "requirepass $(cat ${lib.escapeShellArg conf.requirePassFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterUser != null) ''
+                  echo "masteruser ${conf.masterUser}" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterAuthFile != null) ''
+                  echo "masterauth $(cat ${lib.escapeShellArg conf.masterAuthFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.sentinelMasterHost != null) ''
+                  sentinel_monitor_line="sentinel monitor ${conf.sentinelMasterName} ${conf.sentinelMasterHost} ${toString conf.sentinelMasterPort} ${toString conf.sentinelMasterQuorum}"
+                  if grep -qE "^sentinel monitor ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel monitor ${conf.sentinelMasterName}\b.*|$sentinel_monitor_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_monitor_line" >> "${redisConfVar}"
+                  fi
+                ''}
+                ${lib.optionalString (conf.sentinelAuthUser != null) ''
+                  sentinel_auth_user_line="sentinel auth-user ${conf.sentinelMasterName} ${conf.sentinelAuthUser}"
+                  if grep -qE "^sentinel auth-user ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-user ${conf.sentinelMasterName}\b.*|$sentinel_auth_user_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_user_line" >> "${redisConfVar}"
+                  fi
+                ''}
+                ${lib.optionalString (conf.sentinelAuthPassFile != null) ''
+                  sentinel_auth_pass_line="sentinel auth-pass ${conf.sentinelMasterName} $(cat ${lib.escapeShellArg conf.sentinelAuthPassFile})"
+                  if grep -qE "^sentinel auth-pass ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-pass ${conf.sentinelMasterName}\b.*|$sentinel_auth_pass_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_pass_line" >> "${redisConfVar}"
+                  fi
                 ''}
               ''
             );