diff --git a/nixos/module/hectic/service/immich.nix b/nixos/module/hectic/service/immich.nix
index c7a676e9..82ec4315 100644
--- a/nixos/module/hectic/service/immich.nix
+++ b/nixos/module/hectic/service/immich.nix
@@ -59,25 +59,25 @@ in
 
       host = lib.mkOption {
         type = lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9.-]*";
-        default = "u666713.your-storagebox.de";
+        default = "u666713-sub1.your-storagebox.de";
         description = "Hetzner Storage Box SMB hostname.";
       };
 
       username = lib.mkOption {
         type = lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9_-]*";
-        default = "u666713";
+        default = "u666713-sub1";
         description = "Storage Box SMB username.";
       };
 
       share = lib.mkOption {
         type = lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9_-]*";
-        default = "backup";
+        default = "u666713-sub1";
         description = "SMB share exported by Storage Box.";
       };
 
       subdirectory = lib.mkOption {
-        type = lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9_./-]*";
-        default = "immich";
+        type = lib.types.nullOr (lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9_./-]*");
+        default = null;
         description = "Directory within the SMB share used by Immich.";
       };
 
@@ -157,8 +157,8 @@ in
         "gid=${config.services.immich.group}"
         "file_mode=0660"
         "dir_mode=0770"
-        "prefixpath=${cfg.storageBox.subdirectory}"
-      ];
+      ] ++ lib.optional (cfg.storageBox.subdirectory != null)
+        "prefixpath=${cfg.storageBox.subdirectory}";
     };
 
     systemd.services.immich-server.serviceConfig.RequiresMountsFor = lib.mkIf cfg.storageBox.enable [
diff --git a/nixos/module/hectic/service/project-zomboid.nix b/nixos/module/hectic/service/project-zomboid.nix
index 1deb7449..35ae42cb 100644
--- a/nixos/module/hectic/service/project-zomboid.nix
+++ b/nixos/module/hectic/service/project-zomboid.nix
@@ -26,6 +26,7 @@
   sandboxConfigLines = lib.mapAttrsToList (
     name: value: "${name} = ${luaValue value},"
   ) cfg.sandboxProperties;
+  zomboidDir = "${cfg.dataDir}/Zomboid";
   adminPasswordFile = "${cfg.dataDir}/admin-password";
   startScript = pkgs.writeShellScript "project-zomboid-start" ''
     admin_password=$(${pkgs.coreutils}/bin/cat ${lib.escapeShellArg adminPasswordFile})
@@ -165,14 +166,14 @@ in {
           's/"-Xmx[0-9]+[mMgG]"/"-Xmx${cfg.memory}"/' \
           ${lib.escapeShellArg "${cfg.installDir}/ProjectZomboid64.json"}
         ${pkgs.coreutils}/bin/install -d -m 0750 \
-          ${lib.escapeShellArg "${cfg.dataDir}/Server"}
+          ${lib.escapeShellArg "${zomboidDir}/Server"}
         {
           ${lib.concatMapStringsSep "\n  " (line:
             "${pkgs.coreutils}/bin/printf '%s\\n' ${lib.escapeShellArg line};"
           ) configLines}
           ${lib.optionalString (cfg.serverPropertiesFile != null)
             "${pkgs.coreutils}/bin/cat ${lib.escapeShellArg cfg.serverPropertiesFile};"}
-        } > ${lib.escapeShellArg "${cfg.dataDir}/Server/${cfg.serverName}.ini"}
+        } > ${lib.escapeShellArg "${zomboidDir}/Server/${cfg.serverName}.ini"}
         ${lib.optionalString (cfg.sandboxProperties != { }) ''
           {
             ${pkgs.coreutils}/bin/printf '%s\n' 'SandboxVars = {';
@@ -180,7 +181,7 @@ in {
               "${pkgs.coreutils}/bin/printf '%s\\n' ${lib.escapeShellArg line};"
             ) sandboxConfigLines}
             ${pkgs.coreutils}/bin/printf '%s\n' '};';
-          } > ${lib.escapeShellArg "${cfg.dataDir}/Server/${cfg.serverName}_SandboxVars.lua"}
+          } > ${lib.escapeShellArg "${zomboidDir}/Server/${cfg.serverName}_SandboxVars.lua"}
         ''}
       '';
 
diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index d778538a..ab374867 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -63,6 +63,7 @@ in {
     (import ./containers.nix          { inherit flake self inputs; })
     ./experimental-sshd.nix
     (import ./ente.nix               { inherit domain; })
+    (import ./immich.nix             { inherit domain; })
     (import ./mechabellum.nix         { inherit flake self inputs domain; })
     (import (./. + "/sentinèlla.nix") { inherit flake self inputs domain; })
   ];
@@ -231,6 +232,7 @@ in {
         key = "init-postgresql";
       };
       "atticd/environment" = {};
+      "immich/storage-box" = {};
       "wg-bfs/private-key" = {};
       "gitea-runner/org-registration-token" = {
         sopsFile = flake + "/sus/gitea-runners.yaml";
diff --git a/nixos/system/hectic-lab/immich.nix b/nixos/system/hectic-lab/immich.nix
new file mode 100644
index 00000000..da2f51ae
--- /dev/null
+++ b/nixos/system/hectic-lab/immich.nix
@@ -0,0 +1,16 @@
+{ domain, ... }:
+{
+  config,
+  ...
+}:
+{
+  hectic.services.immich = {
+    enable = true;
+    domain = "immich.${domain}";
+
+    storageBox = {
+      enable = true;
+      credentialsFile = config.sops.secrets."immich/storage-box".path;
+    };
+  };
+}
diff --git a/sus/hectic-lab.yaml b/sus/hectic-lab.yaml
index 8a554d46..246133ee 100644
--- a/sus/hectic-lab.yaml
+++ b/sus/hectic-lab.yaml
@@ -1,3 +1,5 @@
+immich:
+    storage-box: ENC[AES256_GCM,data:eFNo4YaxJL25tM2icmwT+xrgkTybm20bKxCdc9JjG3ijmjM7FeOw/oQ4,iv:Y7GE+IfgQpz3Q4EvXWlPJnrFm08DkUT6qeDOr/nGFEM=,tag:3gtZA0v5dwGUlE34Ijz4Rg==,type:str]
 mailserver:
     security:
         hashedPassword: ENC[AES256_GCM,data:Z03x7tWHIhlRPaRZSrukyYOKhs6LdasZhZdizHdhlaJp2bywQZXKBaDABj2ab4rhwAPCHWhSiBjz35zV,iv:Z3hLC/A4YLVQkflr4cg9/wkKzo/RUdnLTwYC7ZhS0Hk=,tag:mSF/mbzH7iG6PwzyEsmyGg==,type:str]
@@ -81,7 +83,7 @@ sops:
             Yk43ZmlTc09aNFV1VjdjN2RWQlFWTDQKcYSvA2lHP8GS0lkYY19Tm8RXmFHQX5Ck
             qV2Fn22Fic4M5FVKDEMfaO6WmeXgki9a8dGeO9LlC+Phf16SOq7eLw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-06-06T12:32:43Z"
-    mac: ENC[AES256_GCM,data:cmATu3qAaY7B74NvbejyMQMflh3akc0eLV+yal0NrTSE3rMd8rXYiAv1d2j/RxNd2ZLvnj5g6PFBP3O7v0JuYjKcNOvImz7SR2RRIaEWfT9Nl7XGtpTn5EpIi5KiL3unsqZTjvGrRywyLVfg0bxdKxX7RLnrBInX/zPVvMRNCL0=,iv:YpQdmsloPs3LrXA2FodziBCfxNfKrImPSe7TLNO1KH0=,tag:0By4hddfHl/0a5souDsJBw==,type:str]
+    lastmodified: "2026-09-12T22:13:26Z"
+    mac: ENC[AES256_GCM,data:NdCP9Vm8AQej0u3/6evlskRV4B5+QA3gNegQ5s5laoX+SwJNXnrJtAwZBKCWEZQKMb32qI+YVgnIJfn+HaJCkeaDqmc2I8d3DobiucraZypXh2VtWXGe4vCwzbhoc8KDb1eSNKt2e5CIzaR89BQYuwIHdngTSlzJ/qdc02qR1tA=,iv:VQcQoXpMlVCPZkREL35dwKSCCDTbAscDQk01mn9jht0=,tag:oaJTl+uj33/8WVoTv/j7Nw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2