diff --git a/nix/modules/hedgedoc/default.nix b/nix/modules/hedgedoc/default.nix
index 40ca217..0ae32c2 100644
--- a/nix/modules/hedgedoc/default.nix
+++ b/nix/modules/hedgedoc/default.nix
@@ -1,4 +1,4 @@
-{ config, ... }: {
+{ config, pkgs, lib, ... }: {
   age.secrets.hedgedoc_env.file = ../../secrets/hedgedoc_env.age;
 
   services.hedgedoc = {
@@ -8,8 +8,10 @@
     settings = {
       domain = "hedgedoc.noratrieb.dev";
       allowAnonymous = false;
+      allowAnonymousEdits = false;
       protocolUseSSL = true;
-      enableUploads = "none";
+      enableUploads = "registered";
+      allowEmailRegister = false;
       #imageuploadtype = "minio";
       # doesn't work yet :(
       minio = {
@@ -22,6 +24,21 @@
     };
   };
 
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "hedgedoc-manage_users";
+      text = ''
+        CMD_DB_URL="sqlite://${config.services.hedgedoc.settings.db.storage}" ${lib.getExe' pkgs.hedgedoc "manage_users"} "$@"
+      '';
+    })
+    (pkgs.writeShellApplication {
+      name = "hedgedoc-db";
+      text = ''
+        ${lib.getExe pkgs.rlwrap} --always-readline ${lib.getExe pkgs.sqlite-interactive} ${config.services.hedgedoc.settings.db.storage}
+      '';
+    })
+  ];
+
   services.caddy.virtualHosts = {
     "hedgedoc.noratrieb.dev" = {
       logFormat = "";