diff --git a/config/hosts/wind/data/secrets/secrets.nix b/config/hosts/wind/data/secrets/secrets.nix
index 815cba8..063fd3a 100644
Binary files a/config/hosts/wind/data/secrets/secrets.nix and b/config/hosts/wind/data/secrets/secrets.nix differ
diff --git a/config/hosts/wind/data/secrets/synapse_extra_config b/config/hosts/wind/data/secrets/synapse_extra_config
new file mode 100644
index 0000000..2b6eb7a
Binary files /dev/null and b/config/hosts/wind/data/secrets/synapse_extra_config differ
diff --git a/config/hosts/wind/services/synapse.nix b/config/hosts/wind/services/synapse.nix
index 7d9feb2..c5899eb 100644
--- a/config/hosts/wind/services/synapse.nix
+++ b/config/hosts/wind/services/synapse.nix
@@ -4,6 +4,7 @@
   services.matrix-synapse = {
     enable = true;
     withJemalloc = true;
+    extraConfigFiles = [ config.secrets.files.synapse_extra_config.file ];
     settings = {
       server_name = "graven.dev";
       enable_registration = false;
@@ -24,28 +25,6 @@
         "turns:turn.graven.dev:5350?transport=tcp"
       ];
       report_stats = true;
-
-      extraConfig = ''
-  password_config:
-    enabled: false
-  oidc_providers:
-    - idp_id: authentik
-      idp_name: authentik
-      discover: true
-      issuer: "https://auth.graven.dev/application/o/synapse/"
-      client_id: "7a77036d3b360265895f2ab5a51264ba586c93d5"
-      client_secret: "a9f9146fd13338230481a71c824d122bfb5e8a2118f2cdaf882746ad6726aeecd50ef522338acec89d3f8ccb8014124e022a6af6769807ea4271931f219a3f55"
-      allow_existing_users: true
-      scopes:
-        - "openid"
-        - "profile"
-        - "email"
-      user_mapping_provider:
-        config:
-          localpart_template: "{{ user.name }}"
-          display_name_template: "{{ user.name|capitalize }}"
-      '';
-
       logConfig = ''
   version: 1
 
diff --git a/config/sources/nix/sources.json b/config/sources/nix/sources.json
index b49671b..a544f32 100644
--- a/config/sources/nix/sources.json
+++ b/config/sources/nix/sources.json
@@ -17,10 +17,10 @@
         "homepage": "",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "ea3efc80f8ab83cb73aec39f4e76fe87afb15a08",
-        "sha256": "0h87y6z42ch128j6yslydvdzajqcrqzhihi4nrpwida4js2pl1ak",
+        "rev": "12620020f76b1b5d2b0e6fbbda831ed4f5fe56e1",
+        "sha256": "061bvqikx69rz6kz4ya8ksnk226gfdjvzy6j2lbi0vj398xmd2fk",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixos-hardware/archive/ea3efc80f8ab83cb73aec39f4e76fe87afb15a08.tar.gz",
+        "url": "https://github.com/NixOS/nixos-hardware/archive/12620020f76b1b5d2b0e6fbbda831ed4f5fe56e1.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs": {
@@ -29,10 +29,10 @@
         "homepage": "",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c55096e021c6ab0be3945be2535b3b4324e4f571",
-        "sha256": "0smvw72cv80zq1y1y5vjfjbz0bv6mg8iznhv779s2vn5dz1s3kwx",
+        "rev": "22b6dc7dbd0fed58f41c117123494c6ed691fdb8",
+        "sha256": "1p88904pshasnivgw44m3vv14gwrq6cf25301spx3vpw89f48d2a",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/c55096e021c6ab0be3945be2535b3b4324e4f571.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/22b6dc7dbd0fed58f41c117123494c6ed691fdb8.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixus": {
@@ -41,10 +41,10 @@
         "homepage": "",
         "owner": "Infinisil",
         "repo": "nixus",
-        "rev": "a7b742f2f4c9d37cd84b8f0ab7ee57c4b3d9f393",
-        "sha256": "0pyplivs96vxnnnj3w8drd806xxzhrxcn969hh1bhbds4h4s5k16",
+        "rev": "bc40879a51c0739b83e3a0bd6381fe0bf51b0649",
+        "sha256": "0ky0dgrfpsgcgzk1jfzqzfa7f4pjrpqijjqbg97mpibwmxzj5qr4",
         "type": "tarball",
-        "url": "https://github.com/Infinisil/nixus/archive/a7b742f2f4c9d37cd84b8f0ab7ee57c4b3d9f393.tar.gz",
+        "url": "https://github.com/Infinisil/nixus/archive/bc40879a51c0739b83e3a0bd6381fe0bf51b0649.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }