diff --git a/nixos/modules/services/backup/restic-rest-server.nix b/nixos/modules/services/backup/restic-rest-server.nix
index 5850b17e9cb7..2f82c406c415 100644
--- a/nixos/modules/services/backup/restic-rest-server.nix
+++ b/nixos/modules/services/backup/restic-rest-server.nix
@@ -36,6 +36,12 @@ in
       '';
     };
 
+    htpasswd-file = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.path;
+      description = "The path to the servers .htpasswd file. Defaults to {dataDir}/htpasswd.";
+    };
+
     privateRepos = lib.mkOption {
       default = false;
       type = lib.types.bool;
@@ -84,6 +90,7 @@ in
         ExecStart = ''
           ${cfg.package}/bin/rest-server \
           --path ${cfg.dataDir} \
+          --htpasswd-file ${cfg.htpasswd-file} \
           ${lib.optionalString cfg.appendOnly "--append-only"} \
           ${lib.optionalString cfg.privateRepos "--private-repos"} \
           ${lib.optionalString cfg.prometheus "--prometheus"} \
@@ -112,6 +119,7 @@ in
         ProtectControlGroups = true;
         PrivateDevices = true;
         ReadWritePaths = [ cfg.dataDir ];
+        ReadOnlyPaths = [ cfg.htpasswd-file ];
         RemoveIPC = true;
         RestrictAddressFamilies = "none";
         RestrictNamespaces = true;