diff --git a/services/crowdsec.nix b/services/crowdsec.nix
index e6ec713..7a6ded1 100644
--- a/services/crowdsec.nix
+++ b/services/crowdsec.nix
@@ -80,6 +80,9 @@ in
       settings = {
         # config.yaml — main agent + LAPI configuration
         config.api.server.listen_uri = "127.0.0.1:8081";  # 8080 is qBit
+        # CAPI: community blocklist + console (app.crowdsec.net). Setup auto-registers.
+        config.api.server.online_client.credentials_path = "/var/lib/crowdsec/data/online_api_credentials.yaml";
+        console.enrollKeyFile = "/var/secrets/crowdsec-enroll-key";
 
         # Drop alerts originating from LAN clients before they're scored.
         # Without this, repeated Authelia 401s from inside the house (e.g.