diff --git a/kyra/systemd/step-ca-service.nix b/kyra/systemd/step-ca-service.nix
new file mode 100644
index 0000000..cd61269
--- /dev/null
+++ b/kyra/systemd/step-ca-service.nix
@@ -0,0 +1,13 @@
+{config, ...}: {
+  systemd = {
+    services = {
+      "step-ca" = {
+        serviceConfig = {
+          EnvironmentFile = [
+            config.sops.templates."step-ca.env".path
+          ];
+        };
+      };
+    };
+  };
+}