diff --git a/hosts/koi/containers/pds/default.nix b/hosts/koi/containers/pds/default.nix
index 11c7b00..bb72a55 100644
--- a/hosts/koi/containers/pds/default.nix
+++ b/hosts/koi/containers/pds/default.nix
@@ -3,23 +3,51 @@
 
 let 
   secrets = import (abs "lib/secrets.nix");
+
+  UID = 1106;
 in {
   imports = [
-    (secrets.declare [
-      "bluesky-pds-secrets"
-    ])
-    ((import (abs "lib/containers.nix") inputs).mkDockerComposeContainer {
-      directory = ./.;
-      envFiles = [
-        # PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX, PDS_EMAIL_SMTP_URL
-        (secrets.file config "bluesky-pds-secrets")
-      ];
-    })
+    (secrets.declare [{
+      name = "bluesky-pds-secrets";
+      owner = "bluesky-pds";
+    }])
   ];
 
+  users.groups.bluesky-pds = {};
+  users.users.bluesky-pds = {
+    isNormalUser = true;
+    uid = UID;
+  };
+
+  virtualisation.oci-containers.containers.bluesky-pds = {
+    image = "ghcr.io/bluesky-social/pds:sha-12da4359e5ff2eed69c4ab7d142364d561276a9d";
+    volumes = [
+      "/srv/bluesky-pds/data:/pds"
+      "/mnt/puffer/bluesky-pds:/blobstore"
+    ];
+    environment = {
+      PDS_HOSTNAME = "pds.stupid.fish";
+      PDS_DATA_DIRECTORY = "/pds";
+      PDS_BLOBSTORE_DISK_LOCATION = "/blobstore";
+      PDS_DID_PLC_URL = "https://plc.directory";
+      PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";
+      PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
+      PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
+      PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
+      PDS_CRAWLERS = "https://bsky.network";
+      LOG_ENABLED = "true";
+      PDS_INVITE_REQUIRED = "true";
+    };
+    environmentFiles = [
+      # PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
+      (secrets.file config "bluesky-pds-secrets")
+    ];
+    user = builtins.toString UID;
+  };
+
   systemd.tmpfiles.rules = [
-    "d /mnt/puffer/bluesky-pds 0777 root root -"
-    "d /srv/bluesky-pds/data 0777 root root -"
+    "d /mnt/puffer/bluesky-pds 0700 ${builtins.toString UID} ${builtins.toString UID} -"
+    "d /srv/bluesky-pds/data 0700 ${builtins.toString UID} ${builtins.toString UID} -"
   ];
 
   services.nginx.virtualHosts."pds.stupid.fish" = {
@@ -32,7 +60,7 @@ in {
     '';
     
     locations."/" = {
-      proxyPass = "http://pds.pds.docker:3000$request_uri";
+      proxyPass = "http://bluesky-pds.docker:3000$request_uri";
       proxyWebsockets = true;
     };
   };
diff --git a/hosts/koi/containers/pds/docker-compose.yaml b/hosts/koi/containers/pds/docker-compose.yaml
deleted file mode 100644
index 95fff33..0000000
--- a/hosts/koi/containers/pds/docker-compose.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-version: "3"
-
-services:
-  pds:
-    image: ghcr.io/bluesky-social/pds:sha-3f0cdfa8441c578eb42eb6e5eadbf909abe9ecfd
-    restart: unless-stopped
-    environment: 
-      - PDS_HOSTNAME=pds.stupid.fish
-      - PDS_DATA_DIRECTORY=/pds
-      - PDS_BLOBSTORE_DISK_LOCATION=/blobstore
-      - PDS_DID_PLC_URL=https://plc.directory
-      - PDS_BSKY_APP_VIEW_URL=https://api.bsky.app
-      - PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app
-      - PDS_REPORT_SERVICE_URL=https://mod.bsky.app
-      - PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
-      - PDS_CRAWLERS=https://bsky.network
-      - LOG_ENABLED=true
-      - PDS_EMAIL_FROM_ADDRESS=alina@tei.su
-      - PDS_INVITE_REQUIRED=true
-      # forward secret variables
-      - PDS_JWT_SECRET=$PDS_JWT_SECRET
-      - PDS_ADMIN_PASSWORD=$PDS_ADMIN_PASSWORD
-      - PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
-      - PDS_EMAIL_SMTP_URL=$PDS_EMAIL_SMTP_URL
-    volumes:
-      - type: bind
-        source: /srv/bluesky-pds/data
-        target: /pds
-      - type: bind
-        source: /mnt/puffer/bluesky-pds
-        target: /blobstore
diff --git a/secrets/bluesky-pds-secrets.age b/secrets/bluesky-pds-secrets.age
index 0a235c5..ee2a000 100644
Binary files a/secrets/bluesky-pds-secrets.age and b/secrets/bluesky-pds-secrets.age differ