diff --git a/nixos/modules/services/torrent/bitmagnet.nix b/nixos/modules/services/torrent/bitmagnet.nix
index 2d8ce218d427..d2e140131df3 100644
--- a/nixos/modules/services/torrent/bitmagnet.nix
+++ b/nixos/modules/services/torrent/bitmagnet.nix
@@ -14,6 +14,7 @@ let
     optional
     ;
   inherit (lib.types)
+    nullOr
     bool
     port
     str
@@ -43,10 +44,10 @@ in
             type = submodule {
               inherit freeformType;
               options = {
-                port = mkOption {
+                local_address = mkOption {
                   type = str;
                   default = ":3333";
-                  description = "HTTP server listen port";
+                  description = "HTTP server listen address";
                 };
               };
             };
@@ -94,6 +95,20 @@ in
               };
             };
           };
+          tmdb = mkOption {
+            default = { };
+            description = "TMDB api settings";
+            type = submodule {
+              inherit freeformType;
+              options = {
+                api_key = mkOption {
+                  type = nullOr str;
+                  default = null;
+                  description = "TMDB api key, to avoid api limits. Leave null to use the default shared key.";
+                };
+              };
+            };
+          };
         };
       };
     };
@@ -129,6 +144,7 @@ in
       ]
       ++ optional cfg.useLocalPostgresDB "postgresql.target";
       requires = optional cfg.useLocalPostgresDB "postgresql.target";
+      restartTriggers = [ config.environment.etc."xdg/bitmagnet/config.yml".source ];
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
@@ -138,6 +154,7 @@ in
         Restart = "on-failure";
         WorkingDirectory = "/var/lib/bitmagnet";
         StateDirectory = "bitmagnet";
+        BindReadOnlyPaths = [ "/etc/xdg/bitmagnet/config.yml" ];
 
         # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
         ProtectSystem = "strict";