diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..6908e25
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1776877367,
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/webapp.nix b/webapp.nix
index 66c0524..20495fd 100644
--- a/webapp.nix
+++ b/webapp.nix
@@ -41,6 +41,7 @@ let
     VITE_LNBITS_BASE_URL = cfg.lnbitsBaseUrl;
     VITE_LNBITS_DEBUG = if cfg.lnbitsDebug then "true" else "false";
     VITE_WEBSOCKET_ENABLED = if cfg.websocketEnabled then "true" else "false";
+    VITE_LNBITS_NOSTR_TRANSPORT_PUBKEY = cfg.lnbitsNostrTransportPubkey;
 
     # Lightning Address Domain
     VITE_LIGHTNING_DOMAIN = cfg.lightningDomain;
@@ -179,6 +180,18 @@ in {
       description = "Enable LNBits debug mode";
     };
 
+    lnbitsNostrTransportPubkey = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      example = "ac766168d4f3232772b16002a059cdf2ffed7293a25da620a2ddbdab7691c07f";
+      description = ''
+        Hex-encoded Nostr public key identifying the LNbits instance on
+        the relay network. The webapp uses this to address NIP-44 v2
+        encrypted kind-21000 RPC requests at the lnbits backend over
+        Nostr instead of HTTP. Empty string = nostr transport disabled.
+      '';
+    };
+
     websocketEnabled = lib.mkOption {
       type = lib.types.bool;
       default = true;