diff --git a/modules/nextcloud/client.ts b/modules/nextcloud/client.ts
index 3ee0ce4..e93d9c7 100644
--- a/modules/nextcloud/client.ts
+++ b/modules/nextcloud/client.ts
@@ -52,8 +52,13 @@ export class NextcloudClient {
     const container = cfg.container ?? env.MESH_NEXTCLOUD_CONTAINER ?? "nextcloud";
     const ocsUrl = cfg.url ?? env.MESH_NEXTCLOUD_URL ?? `http://127.0.0.1:${env.NEXTCLOUD_PORT ?? "80"}`;
     const adminUser = cfg.user ?? env.MESH_NEXTCLOUD_ADMIN_USER ?? "admin";
-    const adminPassword = cfg.password ?? env.MESH_NEXTCLOUD_ADMIN_PASSWORD;
-    if (!adminPassword) throw new Error("no Nextcloud admin password — set MESH_NEXTCLOUD_ADMIN_PASSWORD");
+    const passwordFile = env.MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE;
+    const adminPassword = cfg.password ?? env.MESH_NEXTCLOUD_ADMIN_PASSWORD
+      ?? (passwordFile ? readFileSync(passwordFile, "utf8").trim() : undefined);
+    if (!adminPassword) {
+      throw new Error("no Nextcloud admin password — set MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE " +
+        "(or MESH_NEXTCLOUD_ADMIN_PASSWORD)");
+    }
     return new NextcloudClient(container, ocsUrl.replace(/\/$/, ""), adminUser, adminPassword);
   }
 
diff --git a/modules/nextcloud/module.json b/modules/nextcloud/module.json
index 9eb683e..7c8103b 100644
--- a/modules/nextcloud/module.json
+++ b/modules/nextcloud/module.json
@@ -98,13 +98,6 @@
       "content": "{}\n",
       "merge": "json"
     },
-    {
-      "id": "runtime-admin-env",
-      "type": "file",
-      "path": "/var/lib/mesh/nextcloud/admin.env",
-      "mode": "0600",
-      "content": "MESH_NEXTCLOUD_ADMIN_PASSWORD=${secret:admin}\n"
-    },
     {
       "id": "runtime",
       "type": "container",
@@ -113,15 +106,14 @@
       "volumes": [
         "/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro",
+        "/var/lib/nextcloud-module/admin.secret:/run/secrets/admin:ro",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
-      "env-file": [
-        "/var/lib/mesh/nextcloud/admin.env"
-      ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_NEXTCLOUD_URL": "http://127.0.0.1:80",
-        "MESH_NEXTCLOUD_CONFIG_FILE": "/run/config/config.json"
+        "MESH_NEXTCLOUD_CONFIG_FILE": "/run/config/config.json",
+        "MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
       },
       "restart-on": [
         "runtime-config"