diff --git a/modules/containers/default.nix b/modules/containers/default.nix
index 3b46d2c..cbc8be2 100644
--- a/modules/containers/default.nix
+++ b/modules/containers/default.nix
@@ -15,9 +15,10 @@
       containerJellyfin
       containerMail
       containerN8N
-			containerKomga
+      containerKomga
       containerNginxHomeAssistant
       containerSilverbullet
+      containerPaperless
     ];
   in {
     imports = modules;
diff --git a/modules/containers/paperless-ngx/container.nix b/modules/containers/paperless-ngx/container.nix
new file mode 100644
index 0000000..6e0c83d
--- /dev/null
+++ b/modules/containers/paperless-ngx/container.nix
@@ -0,0 +1,140 @@
+{moduleWithSystem, ...}: {
+  flake.nixosModules.containerPaperless = moduleWithSystem ({pkgs, ...}: {config, ...}: {
+    virtualisation.oci-containers.containers."paperless-ngx-broker" = {
+      image = "docker.io/valkey/valkey:9-alpine";
+      volumes = [
+        "/containers/paperless-ngx/redisdata:/data:rw"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=broker"
+        "--network=paperless-ngx_default"
+      ];
+    };
+    systemd.services."podman-paperless-ngx-broker" = {
+      serviceConfig = {
+        Restart = pkgs.lib.mkOverride 90 "always";
+      };
+      after = [
+        "podman-network-paperless-ngx_default.service"
+      ];
+      requires = [
+        "podman-network-paperless-ngx_default.service"
+      ];
+      partOf = [
+        "podman-compose-paperless-ngx-root.target"
+      ];
+      wantedBy = [
+        "podman-compose-paperless-ngx-root.target"
+      ];
+    };
+    virtualisation.oci-containers.containers."paperless-ngx-db" = {
+      image = "docker.io/library/postgres:18";
+      environmentFiles = [config.sops.templates."paperless.env".path];
+      environment = {
+        "POSTGRES_DB" = "paperless";
+        "POSTGRES_USER" = "paperless";
+      };
+      volumes = [
+        "/containers/paperless-ngx/pgdata:/var/lib/postgresql:rw"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=db"
+        "--network=paperless-ngx_default"
+      ];
+    };
+    systemd.services."podman-paperless-ngx-db" = {
+      serviceConfig = {
+        Restart = pkgs.lib.mkOverride 90 "always";
+      };
+      after = [
+        "podman-network-paperless-ngx_default.service"
+      ];
+      requires = [
+        "podman-network-paperless-ngx_default.service"
+      ];
+      partOf = [
+        "podman-compose-paperless-ngx-root.target"
+      ];
+      wantedBy = [
+        "podman-compose-paperless-ngx-root.target"
+      ];
+    };
+    virtualisation.oci-containers.containers."paperless-ngx-webserver" = {
+      image = "ghcr.io/paperless-ngx/paperless-ngx:latest";
+      environmentFiles = [config.sops.templates."paperless.env".path];
+      environment = {
+        "PAPERLESS_DBENGINE" = "postgresql";
+        "PAPERLESS_DBHOST" = "db";
+        "PAPERLESS_OCR_LANGUAGE" = "eng";
+        "PAPERLESS_REDIS" = "redis://broker:6379";
+        "PAPERLESS_TIME_ZONE" = "Europe/London";
+        "PAPERLESS_URL" = "https://paperless.voidarc.co.uk";
+        "USERMAP_GID" = "0";
+        "USERMAP_UID" = "0";
+      };
+      volumes = [
+        "/containers/paperless-ngx/consume:/usr/src/paperless/consume:rw"
+        "/containers/paperless-ngx/data:/usr/src/paperless/data:rw"
+        "/containers/paperless-ngx/export:/usr/src/paperless/export:rw"
+        "/containers/paperless-ngx/media:/usr/src/paperless/media:rw"
+      ];
+      ports = [
+        "8000:8000/tcp"
+      ];
+      dependsOn = [
+        "paperless-ngx-broker"
+        "paperless-ngx-db"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=webserver"
+        "--network=paperless-ngx_default"
+      ];
+    };
+    systemd.services."podman-paperless-ngx-webserver" = {
+      serviceConfig = {
+        Restart = pkgs.lib.mkOverride 90 "always";
+      };
+      after = [
+        "podman-network-paperless-ngx_default.service"
+      ];
+      requires = [
+        "podman-network-paperless-ngx_default.service"
+      ];
+      partOf = [
+        "podman-compose-paperless-ngx-root.target"
+      ];
+      wantedBy = [
+        "podman-compose-paperless-ngx-root.target"
+      ];
+    };
+
+    # Networks
+    systemd.services."podman-network-paperless-ngx_default" = {
+      path = [pkgs.podman];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStop = "podman network rm -f paperless-ngx_default";
+      };
+      script = ''
+        podman network inspect paperless-ngx_default || podman network create paperless-ngx_default
+      '';
+      partOf = ["podman-compose-paperless-ngx-root.target"];
+      wantedBy = ["podman-compose-paperless-ngx-root.target"];
+    };
+
+
+    # Root service
+    # When started, this will automatically create all resources and start
+    # the containers. When stopped, this will teardown all resources.
+    systemd.targets."podman-compose-paperless-ngx-root" = {
+      unitConfig = {
+        Description = "Root target generated by compose2nix.";
+      };
+      wantedBy = ["multi-user.target"];
+    };
+  });
+}
diff --git a/modules/features/sops/default.nix b/modules/features/sops/default.nix
index 0ca7e1d..3b36e86 100644
--- a/modules/features/sops/default.nix
+++ b/modules/features/sops/default.nix
@@ -24,6 +24,8 @@
         mail-relay-user = {};
         mail-relay-passwd = {};
         silverbullet-user = {};
+        paperless-ngx-key = {};
+        paperless-postgres-password = {};
       };
       templates = {
         "gitea.env".content = ''
@@ -43,6 +45,10 @@
         "silverbullet.env".content = ''
           SB_USER=${config.sops.placeholder.silverbullet-user}
         '';
+        "paperless.env".content = ''
+          POSTGRES_PASSWORD=${config.sops.placeholder.paperless-postgres-password}
+          PAPERLESS_SECRET_KEY=${config.sops.placeholder.paperless-ngx-key}
+        '';
       };
     };
   };
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 3f9b706..5a8ea4f 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -9,6 +9,8 @@ immich-postgres-passwd: ENC[AES256_GCM,data:Kv0l+xMwcBA=,iv:SLzp6Qo1YrwAmrhtg11M
 mail-relay-user: ENC[AES256_GCM,data:yaqB1uJ9N+9LwSsS4VsCsQxK/IPA8A0m,iv:k8c9GVeU4bdH8G+4SVKYOw4X5ytiPn33rnqx7CVn4hs=,tag:P9l6G87kI2CH301PPUmXzw==,type:str]
 mail-relay-passwd: ENC[AES256_GCM,data:9+2KuS27qukbedmG4fLwyw==,iv:+x5EgbJw/fha98CO58lwTxeF1lfZ5dL8W0zkyOvfF8w=,tag:GnMpinf68b2HdISia0wkrg==,type:str]
 silverbullet-user: ENC[AES256_GCM,data:8eoTT+T1+/khV7A96h3KoA==,iv:5wRlIU8hdRnseI5b3WUUZ0KOYtLdyrcON/P+yxg0LCs=,tag:Xxiae5Yrhv2gzIpUPX3PAw==,type:str]
+paperless-ngx-key: ENC[AES256_GCM,data:LxOcEwW4KXHHVM7rQ+qyFyZJX/uuIc5Fc0NDFF7k7qycNcGB1jYq90gAKnz3yf2DnN2FFQQfwc/nS3Z6s+z1bZqFtR6mGdOFQSzu4ALV3CUvY6im518=,iv:cuAGN8L1Rd44WIPCCwj+7W1b110tqG+kftyq9aHwc04=,tag:j3UE1hVAUu4Ch3FZAXdTKA==,type:str]
+paperless-postgres-password: ENC[AES256_GCM,data:lVPWNWuCUx1Q,iv:m8h1xiNoTg5w4lJ6Lv66EEzj5UxvVkEjv9DYG3KkcKw=,tag:QjggXhCCFZ9jrydUmwl3Ng==,type:str]
 sops:
     age:
         - enc: |
@@ -20,7 +22,7 @@ sops:
             XS8/g9qFT4nSgM/8nLhx7I4j5/NQU+CuB/iiG5Zs4iY6+vvAe0jIUg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1rg4rsns375z2zj4tv8cyqtjl504fw8tprlmj2w057dz6ztttjstsgjvkvy
-    lastmodified: "2026-07-31T17:10:29Z"
-    mac: ENC[AES256_GCM,data:RzmgeFEKYRzqEnHMtSxpg7GKleAr64F7bI7EM/FHq/aYyHgtYkn22oGz8uz9/RVijLIyHcL1rJSOyO7RhUSInqfJeSOKLyxI/X1B862ZuqYOkAFSMOeNMl719cINmgw9uHUQD62Tk6VReii1L0Yf2t/l29wObIRTKg96aZPEkjA=,iv:jAWIpSq7jx71RQ6agMu7ULG2IV6oG5U7ri9rbTyQ8JU=,tag:ybo7an+/9pN0sBA73WzGjg==,type:str]
+    lastmodified: "2026-09-23T09:47:48Z"
+    mac: ENC[AES256_GCM,data:M+lBXxSo3WrPGErRGK3xi9jR2Wxkd3OWf+H7xI5BTdT6AOvogwTX2HfhGvTff6HUZDdsZFWNEVWRFkeWJZ3jkK8TVOOf4R0EskcFIn/xANSfBdAVBvh4lc9yVgw0Xh3Z55NVeimMB2FL91wOFP5/vPlIMGZjfrkKeBLZtHKLpPU=,iv:6iWxAdgxZXkJkxdvRlKzN6DF0LZ1j60tKCU0wO5rUdo=,tag:vKe+MTLQBbvxn/PQ7Kw7mQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3