diff --git a/src/haskell/testdata/Arion/NixSpec/arion-context-compose.json b/src/haskell/testdata/Arion/NixSpec/arion-context-compose.json
index bec164b..ae356f6 100644
--- a/src/haskell/testdata/Arion/NixSpec/arion-context-compose.json
+++ b/src/haskell/testdata/Arion/NixSpec/arion-context-compose.json
@@ -6,7 +6,8 @@
     },
     "secrets": {
         "foo": {
-            "environment": "FOO"
+            "environment": "FOO",
+            "external": false
         }
     },
     "services": {
diff --git a/src/nix/modules/secrets/secret.nix b/src/nix/modules/secrets/secret.nix
index 8b09fd2..d4fddf9 100644
--- a/src/nix/modules/secrets/secret.nix
+++ b/src/nix/modules/secrets/secret.nix
@@ -28,6 +28,15 @@ in
       type = types.nullOr types.str;
     };
 
+    external = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether the value of this secret is set via other means.
+        ${secretRef "secrets"}
+      '';
+    };
+
     out = mkOption {
       internal = true;
       description = ''
@@ -48,6 +57,7 @@ in
             inherit (options)
               file
               environment
+              external
               ;
           }
         );