diff --git a/configuration.nix b/configuration.nix
index 779dbba..ebc6b3a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -41,6 +41,8 @@
     defaultSopsFile = ./secrets.yaml;
     age.sshKeyPaths = [ "/root/id_ed25519" ];
     secrets.github-access-token = { };
+    secrets.namecheap-api-user = { };
+    secrets.namecheap-api-key = { };
   };
   nix.extraOptions = "!include /run/secrets/github-access-token";
 
diff --git a/nginx.nix b/nginx.nix
index 3553ffa..9b2c583 100644
--- a/nginx.nix
+++ b/nginx.nix
@@ -22,9 +22,17 @@
     };
   };
 
-  services.certbot = {
-    enable = true;
-    agreeTerms = true;
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "kyren223@proton.me";
+    certs."kyren.codes" = {
+      extraDomainNames = [ "*.kyren.codes" ];
+      dnsProvider = "namecheap";
+      environmentFile = "${pkgs.writeText "namecheap-creds" ''
+        NAMECHEAP_API_USER=${builtins.readFile "/run/secrets/namecheap-api-user"}
+        NAMECHEAP_API_KEY=${builtins.readFile "/root/namecheap-api-key"}
+      ''}";
+    };
   };
 
   networking.firewall.allowedTCPPorts = [ 80 ];
diff --git a/secrets.yaml b/secrets.yaml
index ed753aa..609d3bf 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -1,4 +1,6 @@
 github-access-token: ENC[AES256_GCM,data:VXzObn7doHiMzHzzLaBp8Awe3lO256zUoC8u06APR2WQitvJZs1EIqJs92rA5aORny4J6EahBaKRlcrur8oxBfRSAYkzXrECNm6E8mDYFelKv3sjXlPC3KHvHWtNewkkOA8yDOjdvw7kQVWsqZcO73GxZtN6/LgNiZfW7HMC,iv:3jr6uz+3ZUmIXP9aeqzOtvrHZhbc7Wpbdi1ZA0L8r+I=,tag:4eaV7GsdGrP7sLZAPVIDyQ==,type:str]
+namecheap-api-user: ENC[AES256_GCM,data:noc2o4ID0v2uPQigksGIqpdWheo=,iv:aGcW2EsKSFRfTyf8QinWfZDpcPiM1RdLWvDEtkn672s=,tag:GeKNFYxKwSY/ET+cItyJAA==,type:str]
+namecheap-api-key: ENC[AES256_GCM,data:4cfLurohMYez7dPNNuubEH6IB9h6kcAiJIHoHpjvhy3ZYsZBVyjLxnRVgBMFp1WCynu45KIaY7f91z8xgGUcnw==,iv:txQooTDSGwVsQl1xx220XGw2o+sMoOGNBJnU3ssvW3s=,tag:4P2+h+Orqbb0qLx0HIUAig==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -14,8 +16,8 @@ sops:
             b254YjZLRm9odks2Y1Erdk1NSU1CVncKnhMnBLjSLfMO3A7gTUI9vIRQvaK07I7k
             mQdtsGZM+1FqlbxsFIoqji+xrqAvcBQENott5+tuFM+ePT5EjQUYGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-26T20:26:03Z"
-    mac: ENC[AES256_GCM,data:3W/qNv9SqatnMcG42+CtSRIamAB5etxgxXhn/XEbk4wc24LI3I+Gjlibi9NLcXlGqEOdHdUFfT1BIZKHf4mlftAjoDH6HBsiSUBPNeWsZb1WX5NZQAekx8ENRTJZCzwJ6ZOJboyDiJRNj4IyEbGNAwvpSdQz5imE31NYpQIQ9IQ=,iv:bCSpjQ6noX4VKOart5cTdQXxVYA2qazF64NhTFMhgm8=,tag:uEmeQROpxLp2sGIItGcimA==,type:str]
+    lastmodified: "2024-12-27T15:24:46Z"
+    mac: ENC[AES256_GCM,data:iSXS5uFI4YL1WIZZ7pT5JSWlrnVWc/5QdbrJ5CxFS9SEOKlgCbHToLymd2u8pHjvDVvckaSKvjf1KNV0nq8v+ccxlplzBhsRc/sZwestqqvn1JeAlPGOg6qxvWarLr2/T47XONM7bNtq6AjgE1s+pnrXeK0zZh7Y733i7+WG63I=,iv:CbEBXuiX/WSKnrTlqrg4TEzokKCT44K1Eq2TaC1JUM8=,tag:KVTRIejSatPQ2EyWUkTWNw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1