diff --git a/nix/pkgs/updateplexpass.sh b/nix/pkgs/updateplexpass.sh
index fdca5aca8a..8a7d9885e9 100755
--- a/nix/pkgs/updateplexpass.sh
+++ b/nix/pkgs/updateplexpass.sh
@@ -3,7 +3,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-VERSION_JSON_URL="https://plex.tv/pms/downloads/5.json?channel=plexpass"
+VERSION_JSON_URL="https://plex.tv/pms/downloads/5.json?channel=plexpass&X-Plex-Token=$(vault kv get -field=token kv/apps/plex-pass)"
 alias jq="nix run depot.pkgs.jq -c jq"
 VERSION_JSON="$(curl "$VERSION_JSON_URL")"
 
diff --git a/ops/vault/cfg/config.nix b/ops/vault/cfg/config.nix
index d1df1f4149..f1a1762823 100644
--- a/ops/vault/cfg/config.nix
+++ b/ops/vault/cfg/config.nix
@@ -66,6 +66,7 @@
   '';
   my.apps.authentik = {};
   my.apps.gitlab-runner = {};
+  my.apps.plex-pass = {};
 
   my.servers.etheroute-lon01.apps = [ "pomerium" ];
   my.servers.porcorosso.apps = [ "quotesdb" ];
@@ -76,5 +77,6 @@
   my.servers.bvm-matrix.apps = [ "turn" "matrix-synapse" ];
   my.servers.bvm-prosody.apps = [ "turn" ];
   my.servers.bvm-heptapod.apps = [ "gitlab-runner" ];
+  my.servers.bvm-nixosmgmt.apps = [ "plex-pass" ];
   my.servers.blade-tuvok.apps = [ "fup" ];
 }