diff --git a/nixos/modules/services/misc/ntfy-sh.nix b/nixos/modules/services/misc/ntfy-sh.nix
index b69c03a6679d..8e10576f54e4 100644
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@@ -61,6 +61,18 @@ in
         Configuration for ntfy.sh, supported values are [here](https://ntfy.sh/docs/config/#config-options).
       '';
     };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/ntfy";
+      description = ''
+        Path to a file containing extra ntfy environment variables in the systemd `EnvironmentFile`
+        format. Refer to the [documentation](https://docs.ntfy.sh/config/) for config options.
+
+        This can be used to pass secrets such as creating declarative users or token without putting them in the Nix store.
+      '';
+    };
   };
 
   config =
@@ -109,6 +121,7 @@ in
           MemoryDenyWriteExecute = true;
           # Upstream Recommendation
           LimitNOFILE = 20500;
+          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         };
       };
 
diff --git a/nixos/tests/ntfy-sh.nix b/nixos/tests/ntfy-sh.nix
index b0dba5f0647b..a2bf0d6e4faa 100644
--- a/nixos/tests/ntfy-sh.nix
+++ b/nixos/tests/ntfy-sh.nix
@@ -1,28 +1,42 @@
-import ./make-test-python.nix {
-  name = "ntfy-sh";
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  {
+    name = "ntfy-sh";
 
-  nodes.machine =
-    { ... }:
-    {
-      services.ntfy-sh.enable = true;
-      services.ntfy-sh.settings.base-url = "http://localhost:2586";
-    };
+    nodes.machine =
+      { ... }:
+      {
+        services.ntfy-sh.enable = true;
+        services.ntfy-sh.settings.base-url = "http://localhost:2586";
 
-  testScript = ''
-    import json
+        # Create a user with user:123
+        services.ntfy-sh.environmentFile = pkgs.writeText "ntfy.env" ''
+          NTFY_AUTH_DEFAULT_ACCESS='deny-all'
+          NTFY_AUTH_USERS='user:$2a$12$W2v7IQhkayvJOYRpg6YEruxj.jUO3R2xQOU7s1vC3HzLLB9gSKJ9.:user'
+          NTFY_AUTH_ACCESS='user:test:rw'
+        '';
+      };
 
-    msg = "Test notification"
+    testScript = ''
+      import json
 
-    machine.wait_for_unit("multi-user.target")
+      msg = "Test notification"
 
-    machine.wait_for_open_port(2586)
+      machine.wait_for_unit("multi-user.target")
 
-    machine.succeed(f"curl -d '{msg}' localhost:2586/test")
+      machine.wait_for_open_port(2586)
 
-    notif = json.loads(machine.succeed("curl -s localhost:2586/test/json?poll=1"))
+      machine.succeed(f"curl -u user:1234 -d '{msg}' localhost:2586/test")
 
-    assert msg == notif["message"], "Wrong message"
+      # If we have a user, receive a message
+      notif = json.loads(machine.succeed("curl -u user:1234 -s localhost:2586/test/json?poll=1"))
+      assert msg == notif["message"], "Wrong message"
 
-    machine.succeed("ntfy user list")
-  '';
-}
+      # If we have no user, we should get forbidden, making sure the default access config works
+      notif = json.loads(machine.succeed("curl -s localhost:2586/test/json?poll=1"))
+      assert 403 == notif["http"], f"Should return 403, got {notif["http"]}"
+
+      machine.succeed("ntfy user list")
+    '';
+  }
+)