diff --git a/hosts/harbor/configuration.nix b/hosts/harbor/configuration.nix
index f3e25d0..8262431 100644
--- a/hosts/harbor/configuration.nix
+++ b/hosts/harbor/configuration.nix
@@ -29,6 +29,10 @@
     owner = config.hive.gotify-instance.user;
     key = "adminPassword";
   };
+  sops.secrets.ketesa-hs-secret = {
+    format = "binary";
+    sopsFile = ../../secrets/harbor/ketesa_hs_ed25519_secret_key;
+  };
   sops.secrets.matrix-hs-secret = {
     format = "binary";
     sopsFile = ../../secrets/harbor/hs_ed25519_secret_key;
@@ -37,10 +41,6 @@
     sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
     key = "hostname";
   };
-  sops.secrets.hidden-matrix-registration-secret = {
-    sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
-    key = "registration_secret";
-  };
 
   # gc settings and binary caches
   nix = {
@@ -95,9 +95,9 @@
   hive.wg.server.enable = true;
   hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
   hive.matrix.enable = true;
+  hive.matrix.ketesaHiddenServiceSecret = config.sops.secrets.ketesa-hs-secret.path;
   hive.matrix.hiddenServiceSecret = config.sops.secrets.matrix-hs-secret.path;
   hive.matrix.hiddenServiceHostnameSopsKey = config.sops.secrets.hidden-matrix-hostname.name;
-  hive.matrix.registrationSecretSopsKey = config.sops.secrets.hidden-matrix-registration-secret.name;
   hive.calibre.enable = true;
   hive.calibre.instanceFQDN = "calibre.jroeger.de";
   hive.calibre.libraries = ["Rote Bücher" "Bürgerliche Bücher" "Brain Maxxing" "Technik" "Wissenschaft oder so" "Dokumente"];
diff --git a/modules/services/matrix.nix b/modules/services/matrix.nix
index c1fd45f..0877032 100644
--- a/modules/services/matrix.nix
+++ b/modules/services/matrix.nix
@@ -2,10 +2,13 @@
   flake.nixosModules.matrix = {
     config,
     lib,
-    pkgs,
     ...
   }: let
     cfg = config.hive.matrix;
+    ketesa-web-root = fetchTarball {
+      url = "https://github.com/etkecc/ketesa/releases/download/v1.4.0/ketesa.tar.gz";
+      sha256 = "sha256:0za0rddcbxn2ra4xlykn7v8b4j0ddyacivyzp91m80r071ds1dk7";
+    };
   in {
     options.hive.matrix = {
       enable = lib.mkEnableOption "Enable matrix server (synapse)";
@@ -16,9 +19,10 @@
         description = "The internal port of the synapse server";
       };
 
-      registrationSecretSopsKey = lib.mkOption {
-        type = lib.types.str;
-        description = "The sops key of the secret containing the registration secret";
+      ketesaLocalPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8475;
+        description = "The internal port of the ketesa virtual host";
       };
 
       hiddenServiceHostnameSopsKey = lib.mkOption {
@@ -29,10 +33,9 @@
         type = lib.types.path;
         description = "The file containing the hidden service's secret";
       };
-      instanceFQDN = lib.mkOption {
-        type = lib.types.str;
-        example = "nextcloud.example.com";
-        description = "Fully qualified domain name of the Nextcloud instance";
+      ketesaHiddenServiceSecret = lib.mkOption {
+        type = lib.types.path;
+        description = "The file containing the ketesa hidden service's secret";
       };
     };
 
@@ -59,6 +62,32 @@
             }
           ];
         };
+        relay.onionServices.ketesa = {
+          secretKey = cfg.ketesaHiddenServiceSecret;
+          version = 3;
+          map = [
+            {
+              port = 80;
+              target = {
+                addr = "127.0.0.1";
+                port = cfg.ketesaLocalPort;
+              };
+            }
+          ];
+        };
+      };
+
+      # Virtual host for ketesa
+      services.nginx.virtualHosts."ketesa-localhost" = {
+        listen = [
+          {
+            addr = "127.0.0.1";
+            port = cfg.ketesaLocalPort;
+          }
+        ];
+        forceSSL = false;
+        enableACME = false;
+        root = "${ketesa-web-root}";
       };
 
       # Secret hostname for matrix-synapse
@@ -66,7 +95,6 @@
       sops.templates."hidden-matrix-synapse".content = ''
         server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
         public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
-        registration_shared_secret: "${config.sops.placeholder.${cfg.registrationSecretSopsKey}}"
       '';
 
       # Synapse
@@ -90,7 +118,7 @@
           }
         ];
         settings = {
-          enable_registration = false;
+          enable_registration = true;
           registration_requires_token = true;
           report_stats = false;
           federation_domain_whitelist = [];
diff --git a/secrets/harbor/ketesa_hs_ed25519_secret_key b/secrets/harbor/ketesa_hs_ed25519_secret_key
new file mode 100644
index 0000000..32fe430
--- /dev/null
+++ b/secrets/harbor/ketesa_hs_ed25519_secret_key
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:+BOkCDyX67+vmEPYdGM4im44QiLjFuC6reUU30WeUZRIy5aanyxrTYjFfdEF7g42RpB3zeZjOY5uhtfAnJZLggXz4whbKg8AqMZoBXuL14vniuklO0iubTyMChjQA2mm,iv:A1Lng4Qr0/KXGzrZXbDvwgYJI75ODT3py/oFXNtPQHk=,tag:eMwm4PtjJ6WfrXeX9vT/Jw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZ2xGVWY2OUo5dyttOXdv\nZmE5eTkwVkc5TWlPbVU1dDVQOXBzNTVzbzEwCmRBZEhtUm9PMG9zdExJNlhqU1hU\ndVRkM3BqVEVwVXdHOEYrNkpyL1FoTDgKLS0tIExEdHNFbFpWVWhpbWJsMmU1QzNH\nTXJpSmhJSnNpaEVxZ2RiTkExV2l5K0EKb+VLqFeQ2o/C674Rl6bfsOgRPqlW0U4B\nygPzyCpq0pZke0auLdeNYsvlI/+0D1LIVskWmGGClDVIyuCIvtnKZw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdjdkZVQ2MjMyNllnN0lE\naDhHVThXVmloU2d1UWk0NUl5MTZ3bHVVcFEwClNxdThxVUZmRkZRNlhxaXNkcExT\nU1AxbmJLS21CdVFhdVJmd2hNSW1pRDAKLS0tIHp0Q1Z3SGQ3V3h2eExmQjJyZGF5\nWUo2L1JuVFVnb3k1UktQc1R5R3E5KzQKk8FUGGAUNC2pd+kEYvA5LcB1hQv6nrtR\nNLD1wYap7mE4yBKnAfHUqilPmiPPYqeCZFuQ5v2YJe0TH6nWV0Hq7w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z"
+			}
+		],
+		"lastmodified": "2026-09-03T13:42:49Z",
+		"mac": "ENC[AES256_GCM,data:FY14QBkfIsPVkse+DzLEggDYRpuoqWh3KmTOghQLRSGMFdWJVYfc0ljSrFaiCf3qMojmLGmHStkcQ9fSmlYDJiK7Rk8DGehv76XH5OfWin9tulO6ll3acZqygxLthq2uqsFmfj4/kB6RnB2AAjMqS5NhUup+7vHgzriVEAX0Ti0=,iv:MCbYQy6I69Hfw+J5fkqpHC6ok5ZGt6+WiBTCHOOVZfU=,tag:yWQn8CYmGsbHxqD7ZyZwDQ==,type:str]",
+		"version": "3.13.3"
+	}
+}