diff --git a/hosts/matemat/default.nix b/hosts/matemat/default.nix
index 9640dae5..5966d06a 100644
--- a/hosts/matemat/default.nix
+++ b/hosts/matemat/default.nix
@@ -16,7 +16,10 @@
         enableACME = true;
         locations."/" = {
           proxyPass = "http://localhost:3000";
-          extraConfig = libC.hqNetworkOnly;
+          extraConfig = libC.hqNetworkOnly + ''
+            auth_basic secured;
+            auth_basic_user_file ${config.sops.secrets."nginx/basic-auth".path};
+          '';
         };
       };
     };