diff --git a/hosts/glyph/secrets/open-webui-env.age b/hosts/glyph/secrets/open-webui-env.age
new file mode 100644
index 00000000..6b415448
Binary files /dev/null and b/hosts/glyph/secrets/open-webui-env.age differ
diff --git a/hosts/glyph/services/default.nix b/hosts/glyph/services/default.nix
index 1f8ea9ea..2eeca607 100644
--- a/hosts/glyph/services/default.nix
+++ b/hosts/glyph/services/default.nix
@@ -9,6 +9,7 @@
     ./filebrowser.nix
     ./jellyfin.nix
     ./nfs.nix
+    ./open-webui.nix
     ./prometheus.nix
     ./samba.nix
     ./torrents.nix
@@ -77,6 +78,7 @@
     enable = true;
     paths = [
       "/var/lib/basic-memory"
+      "/var/lib/open-webui"
       "/var/lib/roon-server/backup"
     ];
   };
diff --git a/hosts/glyph/services/open-webui.nix b/hosts/glyph/services/open-webui.nix
new file mode 100644
index 00000000..40db00ef
--- /dev/null
+++ b/hosts/glyph/services/open-webui.nix
@@ -0,0 +1,32 @@
+{config, ...}: {
+  age.secrets.open-webui-env.file = ./../secrets/open-webui-env.age;
+
+  services.open-webui = {
+    enable = true;
+    port = 8888;
+    host = "0.0.0.0";
+    environmentFile = config.age.secrets.open-webui-env.path;
+    environment = {
+      ENABLE_OLLAMA_API = "False";
+      ENABLE_SIGNUP = "False";
+      ENABLE_PERSISTENT_CONFIG = "False";
+      WEBUI_URL = "https://chat.zx.dev";
+      WEBUI_SESSION_COOKIE_SECURE = "True";
+      CORS_ALLOW_ORIGIN = "https://chat.zx.dev";
+
+      # OIDC via Pocket ID
+      ENABLE_OAUTH_SIGNUP = "true";
+      OAUTH_PROVIDER_NAME = "Pocket ID";
+      OPENID_PROVIDER_URL = "https://id.zx.dev/.well-known/openid-configuration";
+      OAUTH_MERGE_ACCOUNTS_BY_EMAIL = "true";
+      OAUTH_SCOPES = "openid email profile groups";
+      ENABLE_OAUTH_ROLE_MANAGEMENT = "true";
+      ENABLE_OAUTH_GROUP_MANAGEMENT = "true";
+      ENABLE_OAUTH_GROUP_CREATION = "true";
+      OAUTH_ROLES_CLAIM = "groups";
+      OAUTH_ALLOWED_ROLES = "users, admins";
+      OAUTH_ADMIN_ROLES = "admins";
+      ENABLE_LOGIN_FORM = "false";
+    };
+  };
+}
diff --git a/lib/secrets/glyph.nix b/lib/secrets/glyph.nix
index 7c5b4dea..89741c57 100644
--- a/lib/secrets/glyph.nix
+++ b/lib/secrets/glyph.nix
@@ -6,4 +6,5 @@ in {
   "hosts/glyph/secrets/pushover-user-token.age".publicKeys = keys;
   "hosts/glyph/secrets/kagi-api-key.age".publicKeys = keys;
   "hosts/glyph/secrets/context7-api-key.age".publicKeys = keys;
+  "hosts/glyph/secrets/open-webui-env.age".publicKeys = keys;
 }
diff --git a/modules/base/unfree-packages.nix b/modules/base/unfree-packages.nix
index 7e2b7e9f..7850d1c3 100644
--- a/modules/base/unfree-packages.nix
+++ b/modules/base/unfree-packages.nix
@@ -12,6 +12,7 @@
       "fastscripts"
       "graphite-cli"
       "mochi"
+      "open-webui"
       "plexmediaserver"
       "roon-server"
       "slack"