diff --git a/flake.lock b/flake.lock
index 8479ee0..93bab8f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -373,6 +373,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-pds": {
+      "locked": {
+        "lastModified": 1791734076,
+        "narHash": "sha256-i5qk1kLiit98rRbh1AXmWBNT9QXC/y4l5Wk/u5EdpDQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "7fd4004d0511991fff3a0524856a9be09e28c5f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
diff --git a/hosts/asusmini/atproto.nix b/hosts/asusmini/atproto.nix
index 1623bbb..3245635 100644
--- a/hosts/asusmini/atproto.nix
+++ b/hosts/asusmini/atproto.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 {
   age.secrets.pds-env = {
     file = ../../secrets/pds-env.age;
@@ -31,12 +31,27 @@
   # full list of options.
   services.tangled.spindle = {
     enable = true;
+    keyPath = "/var/lib/spindle/key.pem";
+    contact.email = "pds@email.commonscomputer.com";
     server = {
       hostname = "spindle.commonscomputer.com";
       owner = "did:plc:om5yygegi4yxcbay5gemn2wm";
     };
   };
 
+  systemd.services.spindle.preStart = ''
+    # Persist the did:web identity across restarts; never put its key in the store.
+    key=${config.services.tangled.spindle.keyPath}
+    if [ ! -e "$key" ]; then
+      umask 0077
+      tmp="$(${pkgs.coreutils}/bin/mktemp "$key.XXXXXX")"
+      trap '${pkgs.coreutils}/bin/rm -f "$tmp"' EXIT
+      ${pkgs.openssl}/bin/openssl ecparam -name prime256v1 -genkey -noout -out "$tmp"
+      ${pkgs.coreutils}/bin/mv "$tmp" "$key"
+      trap - EXIT
+    fi
+  '';
+
   services.tangled.knot = {
     enable = true;
     server = {