diff --git a/services/forgejo/default.nix b/services/forgejo/default.nix
index b4de166..dedda99 100644
--- a/services/forgejo/default.nix
+++ b/services/forgejo/default.nix
@@ -45,7 +45,8 @@ in
         };
 
         session = {
-          PROVIDER = "db";
+          PROVIDER = "redis";
+          PROVIDER_CONFIG = "network=unix,addr=${config.services.redis.servers.forgejo.unixSocket},db=0";
           COOKIE_NAME = "session";
         };
 
@@ -60,7 +61,12 @@ in
         };
 
         # TODO: transactional mails
-        # TODO: redis cache instead of default in-memory
+
+        cache = {
+          ADAPTER = "redis";
+          HOST = "network=unix,addr=${config.services.redis.servers.forgejo.unixSocket},db=1";
+          ITEM_TTL = "72h"; # increased from default 16h
+        };
 
         ui = {
           SHOW_USER_EMAIL = false;
@@ -106,8 +112,13 @@ in
 
       # start Forgejo *after* sshd.service, so in case Forgejo tries to wildcard bind :22 due to
       # a bug or whatever, we don't lose OpenSSH in a race.
-      wants = [ "sshd.service" ];
-      requires = [ "sshd.service" ];
+      wants = [ "sshd.service" "redis-forgejo.service" ];
+      requires = [ "sshd.service" "redis-forgejo.service" ];
+    };
+
+    services.redis.servers.forgejo = {
+      enable = true;
+      user = "forgejo";
     };
 
     services.nginx = {