diff --git a/group_vars/garage_prd_cluster.yml b/group_vars/garage_prd_cluster.yml
index 32dcb98..9b38e6d 100644
--- a/group_vars/garage_prd_cluster.yml
+++ b/group_vars/garage_prd_cluster.yml
@@ -11,4 +11,15 @@ garage_rpc_secret: !vault |
           34303565306134316464363931633933336139323933613133346665313836356634663139353061
           66386436626362316531
 
+garage_admin_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          31636535366661383466393334393333653631623766666666323433636661303534336361393633
+          3437306665333564346461386661313833313935376331330a613566623835373066613338346363
+          62333832633164353837666266643161643463366462366134363734363634643430393231653363
+          6136393434646630380a643635366337356363643435333666303033623361356437373537346435
+          36623933623737313163353737346130636632626364353035623036333561356662386264353031
+          35343564306362386263333433396535363830313864346462383438633462316661613065633232
+          63643366313239306231346433623366646634633131326133356331353237623163323636333834
+          63643061313734353338
+
 garage_root_domain: ".garage.mateu.be"
diff --git a/roles/garage/templates/garage.toml.j2 b/roles/garage/templates/garage.toml.j2
index 86bcf35..4622e9c 100644
--- a/roles/garage/templates/garage.toml.j2
+++ b/roles/garage/templates/garage.toml.j2
@@ -20,6 +20,10 @@ rpc_secret = "{{ garage_rpc_secret }}"
 s3_region = "garage"
 api_bind_addr = "[::]:3900"
 root_domain = "{{ garage_root_domain }}"
+
+[admin]
+api_bind_addr = "[::1]:3903"
+admin_token = "{{ garage_admin_token }}"
 {% if (groups[cluster_group] | select('search', '.+gw.+') | list | length > 0) %}
 {% if 'gw' in inventory_hostname %}
 {{ s3_web % garage_root_domain }}