diff --git a/flake.nix b/flake.nix
index ff2a685..04919d3 100755
--- a/flake.nix
+++ b/flake.nix
@@ -51,6 +51,7 @@
             ./modules/stream.nix
             ./modules/nextcloud.nix
             ./modules/matrix.nix
+            ./modules/mautrix-telegram.nix
             ./modules/sogo.nix
             {
               fsr.enable_office_bloat = false;
diff --git a/modules/mautrix-telegram.nix b/modules/mautrix-telegram.nix
new file mode 100644
index 0000000..105a7a2
--- /dev/null
+++ b/modules/mautrix-telegram.nix
@@ -0,0 +1,71 @@
+{ config, options, lib, pkgs, ... }:
+let
+  homeserverDomain = config.services.matrix-synapse.settings.server_name;
+  registrationFileSynapse = "/var/lib/matrix-synapse/telegram-registration.yaml";
+  registrationFileMautrix = "/var/lib/mautrix-telegram/telegram-registration.yaml";
+  settingsFile = builtins.head (builtins.match ".*--config='(.*)' \\\\.*" config.systemd.services.mautrix-telegram.preStart);
+in
+{
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = "mautrix-telegram";
+      ensurePermissions = {
+        "DATABASE \"mautrix-telegram\"" = "ALL PRIVILEGES";
+      };
+    }];
+    ensureDatabases = [ "mautrix-telegram" ];
+  };
+
+  sops.secrets.mautrix-telegram_env = { };
+
+  services.matrix-synapse.settings.app_service_config_files = [
+    # The registration file is automatically generated after starting the
+    # appservice for the first time.
+    registrationFileSynapse
+  ];
+
+  systemd.tmpfiles.rules = [
+    # copy registration file over to synapse
+    "C ${registrationFileSynapse} - - - - ${registrationFileMautrix}"
+    "Z /var/lib/matrix-synapse/ - matrix-synapse matrix-synapse - -"
+  ];
+
+  services.mautrix-telegram = {
+    enable = true;
+
+    environmentFile = config.sops.secrets.mautrix-telegram_env.path;
+
+    settings = {
+      homeserver = {
+        address = "http://[::1]:8008";
+        domain = homeserverDomain;
+      };
+
+      appservice = rec {
+        # Use postgresql instead of sqlite
+        database = "postgresql:///mautrix-telegram?host=/run/postgresql";
+        port = 8082;
+        address = "localhost:${toString port}";
+      };
+
+      bridge = {
+        relaybot.authless_portals = false;
+        permissions = {
+          "@admin:${homeserverDomain}" = "admin";
+        };
+        relay_user_distinguishers = [ ];
+      };
+    };
+  };
+
+  # If we don't explicitly set {a,h}s_token, mautrix-telegram will try to read them from the registrationFile
+  # and write them to the settingsFile in /nix/store, which obviously fails.
+  systemd.services.mautrix-telegram.serviceConfig.ExecStart =
+    lib.mkForce (pkgs.writeShellScript "start" ''
+      export MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=$(grep as_token ${registrationFileMautrix} | cut -d' ' -f2-)
+      export MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=$(grep hs_token ${registrationFileMautrix} | cut -d' ' -f2-)
+
+      ${pkgs.mautrix-telegram}/bin/mautrix-telegram --config='${settingsFile}'
+    '');
+}
diff --git a/secrets/quitte.yaml b/secrets/quitte.yaml
index b26742a..57392af 100644
--- a/secrets/quitte.yaml
+++ b/secrets/quitte.yaml
@@ -15,6 +15,7 @@ mediawiki:
     postgres: ENC[AES256_GCM,data:XRfUc2PRMJcoILAnm5MWr2Cg5u4e/IhGMUnz/oIQSzY=,iv:8U+qlD1SQzxUyD/6QK4SdwRCDyMODK/lP0IDrLlcQ4U=,tag:2spNMj9dY2wWilOusq24yQ==,type:str]
     initial_admin: ENC[AES256_GCM,data:iET5rz9rygx49NDBjKwqAlRgpeS+jq5iM5zmjnoKcyk=,iv:11iDbCrpzjCdyAB22R8NknJ6vzcpVZXCXB3iWsGWXw0=,tag:1RCyg1ysOWaXKdqqdHqRrw==,type:str]
     ldapprovider: ENC[AES256_GCM,data:CPsrWmUviUpFIVVN/2a1lRjJCoZCWR9zrHm3T5Tv/YuXSYXStZGfBgXN96zhJUUpZcwiJq95o1sajyit+6itZCcGAPu0BTHSnNXRu1fgifonXE0ghw6rvzwkYpfBS+rfmBcG2wxX+7uZG3ulANYpvvGMxpKgM5IzQjE1sAytRDir6QeMGcFHP2gV4xQAdTNUZK2V+EKOlrcV5vTSzDSy3eXg18TVUgZqdxaQFfwnr2UN0eEEZ4Dn83G3QWsROZ0A7R3tuEmdAzmR8AdWBxfqCcOA8vZaOIOWb1AyobLCUaqQOj/SbGdgehMOQn1UcbRHpYQ2E9mvxD572uc/U5kzy/TbOLM34pkvckNrGfxwvqwbvXZrVP3gONY5CnJpk5XfVdT5Au/uwE5ZRs83ZEx31+85mpK3HecyBWRfWID0z2XS8PAU6G7ASQsXCh6sd5LFhL7zhxBQ4ENjT8pDi0OLYvw9VzPhPrdzooULeMytGitVWRtLsSzCn/D+U4x6EJLivLW6jv9SAIKg54fAjNEBYHh7GuHbr/VGtmiWKj6av2e3/BLgPOIyINzNv+X5QSsopZ2/yamPs+ARTOqAZvSyRgqereYoLZ5ZV15jIWiGc7HVfj/+Bk7cN4+VwFhzSuttp1DmvNNIWueeX69rdSqe41Y2lqKZ4ajOSIJ+YLP/dR0wvrVbd7QSP2OVRAnMugmeekbIuyIKPNsNJ183Z4y1m/ihIdRAzLnjSYuYCdWw3LXl5gM0ZTtGb7K+cIYcyJrS3fcaErDmqyI/LJoXNTo5CJI=,iv:ycKt8/awCo3HoO6Oa8H77GH9+m+xgR4kiXb7Cbf0wSY=,tag:b6pBoZs+E4CP+V9oZXrcoQ==,type:str]
+mautrix-telegram_env: ENC[AES256_GCM,data:aksa5kx1fwRz9gu8rNsR6MclUFIttJxMchwLi7yH99T1cYn9YUskeORkvNcgaIPpd4dSPUZMbfWU3gbTlWh8ettI1uCdChg5EXbdOv2CIXfXCsvHx8a6lZPUOcWjoUXGh3693a5xiGv6jeKH4D0Hu50KN70a0XcMyLuW9mBcRnNqpHnzHkFWQNLYw7aHpNOYOz9D0s14DypHkJnVh43SjWvhFZF3tZjGI+kr/I/ZMvQ3/ujx42nuDqNSzT6Qk5e9,iv:JBijgTMjuXhUI2e8RqkLAr/ZRbJJtZTYOYSSX8zsflA=,tag:o1GY3LP7Jk/NnX1EMgEXfg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -30,8 +31,8 @@ sops:
             NEJBTHE2end1RDlHRTNFYlZjTjhib2cKmQRHpBKZ2DbQ5CfOwcSPfZAm9fnnpxUk
             +LcR8haK//O3N2uNf9etDW3VsT5ipPucCdFU1m/v9L5tcN6ZP8WP+w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-03T21:29:19Z"
-    mac: ENC[AES256_GCM,data:rpUgxzTSUAHjCJKIvCXRGSiJF3G4LyTqQXL1x9yUeEe18WHEBWowllMF4S2sqKDU4WLwElCjz/vU8/W3HjrhHK8DHBRIw+7ztol7e3KZdiRJuj+3yazsxo34DkM4mMvA125llFJhhys3w+9WOrdlY9mVITv8uVfLbSYBDLZ6dAg=,iv:K7QXSE7YixdZcPAJo7vXkPvjFuOzkglIxHQefCFYHig=,tag:7gsDdVKLOvjfTQVU0orreA==,type:str]
+    lastmodified: "2023-05-04T14:41:24Z"
+    mac: ENC[AES256_GCM,data:fdQazIIIZJWo5QjbMC9kH1Bu8s9L229q60Zg+8H85JVVpfgwATDTjfg2XcDTEFglpTQAUXCh34AkkX3We5faGb9W6GhX9kc4vc6qwOusX849cojNOVussnZYDSBRmlOLMtQKcArG2yVTjRtOm9jf8Lbff5xts2lsZkXS2iz6qb8=,iv:QWmNyKUCY2LoE0c3dEIsvlg50o0txMjhCvnwjy4xwA8=,tag:JIJ5vEiKoEJ08oehVZZ5Bw==,type:str]
     pgp:
         - created_at: "2023-04-23T17:48:54Z"
           enc: |
diff --git a/secrets/test.yaml b/secrets/test.yaml
index e68e340..22f0d57 100644
--- a/secrets/test.yaml
+++ b/secrets/test.yaml
@@ -15,6 +15,7 @@ mediawiki:
     postgres: ENC[AES256_GCM,data:bna6ksGVOHWor7OqVL/jgeDIxA==,iv:bgkQh+NgPE/hr4N4YOCzSCfs7vaOx4pSWlc8WxI8qMc=,tag:WIjyu1i0M7flGFFovH5jWQ==,type:str]
     initial_admin: ENC[AES256_GCM,data:YRd3O5774NTmshxbQPbFjg==,iv:/Ra3WbZKcnUMf99ujN9qd/+DkOkFKv4cIEfUdmxpqMw=,tag:gj7ZbwIB1HLuPpGTgiz7Vg==,type:str]
     ldapprovider: ENC[AES256_GCM,data:dVrCFVgm4BDtUhcj9rSKXwnaIKsC5GGsDUoPJH1q5F4inskuSbFigcLM/UJFNOcr5R1dL+mYUOvnmIcoWA5AsuFKs3NzSYJVtVAm0x7vYSkHnfXu93V2F8Lc1xX/kZrFfnmNUXwhv2I+hknPUApY7wpmZOdk9NLKv4tbsgVTbfmR/WM6soOurh3b6b4cknfxqSeLZLeOIKL5WL8842t5SethyCfPsCm74JCpwHmflkCyT/lzIP1Kghab+xGWWyN9OAENlDZrJE6VAdctR+MKYZnhA7dXKeQPjKii9MZsDYFYTL5YDRysam4r7Jog/fozgWkXNrCUan29efnnBwpLz5hgV1MguIpvU8ccDQLNvgJCOdp6FgH45ZRlCxx29EWzh9iTDGPqmNsctUknFdfUVfIg9ziz/97i/kGcwy5N1oOsoUf7iRj5zLyLP6OlXGNThowF4jlNdI2b+caQGz7H6ZkJfUPWULotBUrjxrZo3pSYRkpJ77xbGUZf35ysxTHpfsmhyyO9HRhhgNkilEHlcsi8u+AC0su+Htg/Io332tSX+W6Gj6R6Q23hQ0gf8on5Y2xx34ysobEh8cMS4+Kj0nwasMHjW70g3qWpKkG1LSOIgXiA7hcusGCo8xPZ1y3gIyRiTxVTPJHh63Ecd0O37P4NWVSKEpsIM5pkngMN5L5K/ymtZ0kjREX2q4qpXf2xJiTTdAkeTMcmDs9HHjOzIIynYouY7P6qdXUpXjyGwqfovmnIv5icQ6sqFA==,iv:sPRnnIEif6W1SPy5SKiUuY681HeLPcR19U4p1mdUGdc=,tag:zeMdtTRk8ULP4GYDQLIU7A==,type:str]
+mautrix-telegram_env: ENC[AES256_GCM,data:vqHmM3mRrIYMT4760sglAlBZoOb7siqx3alvQE5rpq8z6FgOqJxHqGaN1quhpAVVe9ugtlvezVh8eSFX+45Y5rtqJ7iylxmC+y8JGsyLIflf674Si7h07bedCcT0wBg1ioI/JILDwICiAf0=,iv:BAPKiVt2l3E7z1Wk9ky6WFYr6hn62d+X5r0NMdUYwJQ=,tag:CRddpVMHQLwhwUF1hn0JKA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -30,8 +31,8 @@ sops:
             MERVUkh2ck9YWnJ5TXJDVmxpem1kTXMKCeOyjV/se1nRXsi15m/3i48hP7As6SEk
             ygtLt+UueHStX/b/OzrXk8IC5dj/mARGIJI5S61IKln6SZFbJGT6cQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-03T21:29:36Z"
-    mac: ENC[AES256_GCM,data:tsnXkf9D/EzNozBWEK8fca0S+vSc4fH0y9KXpjlYtcFkgjSjvuwnlo2tH3stdEAo5odHO/rsW29uCvCDomTHwMUeKWmD7NdUAVbBuUNfl6pl6gll9p+9yfTB5lZH9QpFGnC/6ANbwhLN7vBO5ZCRbfpl5hlIN4iQ25GyiPZ/GCM=,iv:2YWxDXfsonj+Td/ZeEBKZYuDpGktEVYw1LBPxqIyofA=,tag:aaX98g7PtGh5Ob81EWmHcA==,type:str]
+    lastmodified: "2023-05-04T14:41:09Z"
+    mac: ENC[AES256_GCM,data:qY1fcRl53tcvgYAqhvWLfAxe6MRvcXcbkeLMtQShQtyKRv4BW0AMOh0OOKFcxxcMbucG4j9yufvK18Q8COIslsOtm5wZhEjK8+sK0RT3l6uX0EPn/aNwGWwScXjMOeKJEBEozA4xPHt7+flTsRDAzjRz+ixC/cevm1Iu/ok17lE=,iv:OTtpuinzQXZ6nykpH8/XwIUYDNf+DNWrbDxCmJpdqAc=,tag:ng3dWwOdj60iy4yT4Ux8Cw==,type:str]
     pgp:
         - created_at: "2022-11-18T16:37:58Z"
           enc: |