diff --git a/flake.lock b/flake.lock
index 7b5b32c..00360bd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -208,6 +208,38 @@
         "url": "https://cdn.jsdelivr.net/npm/htmx-ext-ws@2.0.4"
       }
     },
+    "hydrant": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1792544679,
+        "narHash": "sha256-fm0cuIyHjJTSvleJyLbT4E5KugtanuysL/oMOnGhN3I=",
+        "ref": "refs/heads/main",
+        "rev": "0128352f6b73d26e7ffaa5a79446ef556e452617",
+        "revCount": 811,
+        "type": "git",
+        "url": "https://tangled.org/ptr.pet/hydrant"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.org/ptr.pet/hydrant"
+      }
+    },
+    "hydrant-dev": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1792544679,
+        "narHash": "sha256-fm0cuIyHjJTSvleJyLbT4E5KugtanuysL/oMOnGhN3I=",
+        "ref": "refs/heads/main",
+        "rev": "0128352f6b73d26e7ffaa5a79446ef556e452617",
+        "revCount": 811,
+        "type": "git",
+        "url": "https://tangled.org/ptr.pet/hydrant"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.org/ptr.pet/hydrant"
+      }
+    },
     "ibm-plex-mono-src": {
       "flake": false,
       "locked": {
@@ -325,6 +357,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-pds": {
+      "locked": {
+        "lastModified": 1791734076,
+        "narHash": "sha256-i5qk1kLiit98rRbh1AXmWBNT9QXC/y4l5Wk/u5EdpDQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "7fd4004d0511991fff3a0524856a9be09e28c5f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -432,6 +480,8 @@
         "hls-src": "hls-src",
         "htmx-src": "htmx-src",
         "htmx-ws-src": "htmx-ws-src",
+        "hydrant": "hydrant",
+        "hydrant-dev": "hydrant-dev",
         "ibm-plex-mono-src": "ibm-plex-mono-src",
         "indigo": "indigo",
         "inter-fonts-src": "inter-fonts-src",
@@ -442,15 +492,17 @@
         "nixpkgs": [
           "nixpkgs"
         ],
+        "nixpkgs-pds": "nixpkgs-pds",
         "sqlite-lib-src": "sqlite-lib-src",
-        "tailwindcss-animated-src": "tailwindcss-animated-src"
+        "tailwindcss-animated-src": "tailwindcss-animated-src",
+        "timeless-fonts-src": "timeless-fonts-src"
       },
       "locked": {
-        "lastModified": 1792561894,
-        "narHash": "sha256-Pu6e390+jD9olkxZGYDjto6t+juUjfwcxx2zFYyq8f4=",
+        "lastModified": 1793301352,
+        "narHash": "sha256-fl6toQZeetHRBEGlYgEwdVXnOz7wTuWhb8XbZbnIzdw=",
         "ref": "refs/heads/master",
-        "rev": "12ebb0c96f615a31991c20a144bf08b146bfcabd",
-        "revCount": 3264,
+        "rev": "dfcc014ecfdce4e4fc5e4b33691c8ba17ea61a47",
+        "revCount": 6003,
         "type": "git",
         "url": "https://tangled.org/@tangled.org/core"
       },
@@ -458,6 +510,19 @@
         "type": "git",
         "url": "https://tangled.org/@tangled.org/core"
       }
+    },
+    "timeless-fonts-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1791052084,
+        "narHash": "sha256-zYpoDkE/YrICzYaHF4/NSuINczFWB41YymTxaL6KqLY=",
+        "type": "tarball",
+        "url": "https://media.timeless.co/type/Timeless-Type-Family-1.094.zip"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://media.timeless.co/type/Timeless-Type-Family-1.094.zip"
+      }
     }
   },
   "root": "root",
diff --git a/hosts/asusmini/atproto.nix b/hosts/asusmini/atproto.nix
index 1623bbb..3245635 100644
--- a/hosts/asusmini/atproto.nix
+++ b/hosts/asusmini/atproto.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 {
   age.secrets.pds-env = {
     file = ../../secrets/pds-env.age;
@@ -31,12 +31,27 @@
   # full list of options.
   services.tangled.spindle = {
     enable = true;
+    keyPath = "/var/lib/spindle/key.pem";
+    contact.email = "pds@email.commonscomputer.com";
     server = {
       hostname = "spindle.commonscomputer.com";
       owner = "did:plc:om5yygegi4yxcbay5gemn2wm";
     };
   };
 
+  systemd.services.spindle.preStart = ''
+    # Persist the did:web identity across restarts; never put its key in the store.
+    key=${config.services.tangled.spindle.keyPath}
+    if [ ! -e "$key" ]; then
+      umask 0077
+      tmp="$(${pkgs.coreutils}/bin/mktemp "$key.XXXXXX")"
+      trap '${pkgs.coreutils}/bin/rm -f "$tmp"' EXIT
+      ${pkgs.openssl}/bin/openssl ecparam -name prime256v1 -genkey -noout -out "$tmp"
+      ${pkgs.coreutils}/bin/mv "$tmp" "$key"
+      trap - EXIT
+    fi
+  '';
+
   services.tangled.knot = {
     enable = true;
     server = {