diff --git a/hosts/hetzner-arm/profiles/photoprism.nix b/hosts/hetzner-arm/profiles/photoprism.nix
index e7300e1..012d04a 100644
--- a/hosts/hetzner-arm/profiles/photoprism.nix
+++ b/hosts/hetzner-arm/profiles/photoprism.nix
@@ -1,4 +1,9 @@
-{lib, config, pkgs, ...}: let 
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
   inherit (config.services.secrets) secrets;
 
   rclonePhotos = pkgs.writeShellScriptBin "rclone-photos" ''
@@ -30,6 +35,27 @@ in {
     fuse3
     mountPhotos
     util-linux
+    (let
+      cfg = config.services.photoprism;
+
+      env =
+        {
+          PHOTOPRISM_ORIGINALS_PATH = cfg.originalsPath;
+          PHOTOPRISM_STORAGE_PATH = cfg.storagePath;
+          PHOTOPRISM_IMPORT_PATH = cfg.importPath;
+          PHOTOPRISM_HTTP_HOST = cfg.address;
+          PHOTOPRISM_HTTP_PORT = toString cfg.port;
+        }
+        // (lib.mapAttrs (_: toString) cfg.settings);
+    in
+      pkgs.writeShellScript "photoprism-manage" ''
+        set -o allexport
+        ${lib.toShellVars env}
+        eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
+        exec ${pkgs.util-linux}/bin/nsenter \
+          -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
+          ${cfg.package}/bin/photoprism "$@"
+      '')
   ];
 
   systemd.tmpfiles.rules = [
@@ -50,6 +76,8 @@ in {
     settings = {
       PHOTOPRISM_SITE_URL = "https://photoprism.owo.monster";
       PHOTOPRISM_ADMIN_PASSWORD = "adminadmin";
+      PHOTOPRISM_DETECT_NSFW = false;
+      PHOTOPRISM_UPLOAD_NSFW = true;
     };
   };
 
@@ -76,4 +104,4 @@ in {
     ];
     serviceConfig.ExecStart = "${mountPhotos}/bin/mount-photos --syslog";
   };
-}
\ No newline at end of file
+}
diff --git a/hosts/hetzner-arm/secrets.nix b/hosts/hetzner-arm/secrets.nix
index 4f5e2f9..b3f3f55 100644
--- a/hosts/hetzner-arm/secrets.nix
+++ b/hosts/hetzner-arm/secrets.nix
@@ -66,7 +66,6 @@
       }
     '';
 
-
     secrets = {
       vault_password = {
         manual = true;