diff --git a/machines/genepi/syncthing.nix b/machines/genepi/syncthing.nix
index d554fe0..dd72177 100644
--- a/machines/genepi/syncthing.nix
+++ b/machines/genepi/syncthing.nix
@@ -23,5 +23,17 @@ in
     group = lib.mkForce "users";
     dataDir = home;
     configDir = lib.mkForce "${home}/.config/syncthing";
+    guiPasswordFile = config.clan.core.vars.generators.syncthing-gui.files.password.path;
+  };
+
+  clan.core.vars.generators.syncthing-gui = {
+    files.password = {
+      secret = true;
+      owner = user;
+    };
+    runtimeInputs = [ pkgs.xkcdpass ];
+    script = ''
+      xkcdpass -n 7 > $out/password
+    '';
   };
 }