diff --git a/README.md b/README.md
index 8122ae8..e8aea41 100644
--- a/README.md
+++ b/README.md
@@ -39,8 +39,7 @@ The `nix-bitcoin.nix` module provides the two profiles "minimal" and "all":
     * [nanopos](https://github.com/ElementsProject/nanopos)
     * adds an index page using nginx to display node information and link to nanopos
     * [spark-wallet](https://github.com/shesek/spark-wallet)
-        * Notes: run `nodeinfo` to get its onion address and `systemctl status spark-wallet` to get the access key.
-            When entering the onion address on the Android app don't forgot to prepend "http://"
+        * Notes: run `journalctl -eu spark-wallet` to get the onion address, access key and QR access code for the spark wallet android app.
 * other
     * [electrs](https://github.com/romanz/electrs) can be enabled by setting `services.electrs.enable` in modules `nix-bitcoin.nix` to `true`
 
diff --git a/modules/nix-bitcoin.nix b/modules/nix-bitcoin.nix
index 07d7713..6bb6413 100644
--- a/modules/nix-bitcoin.nix
+++ b/modules/nix-bitcoin.nix
@@ -172,12 +172,7 @@ in {
     services.nix-bitcoin-webindex.enable = cfg.modules == "all";
     services.clightning.autolisten = cfg.modules == "all";
     services.spark-wallet.enable = cfg.modules == "all";
-    services.tor.hiddenServices.spark-wallet = {
-      map = [{
-        port = 80; toPort = 9737;
-      }];
-      version = 3;
-    };
+    services.spark-wallet.onion-service = true;
     services.electrs.enable = false;
     services.electrs.high-memory = false;
     services.tor.hiddenServices.electrs = {
diff --git a/modules/spark-wallet.nix b/modules/spark-wallet.nix
index dd39361..d727e16 100644
--- a/modules/spark-wallet.nix
+++ b/modules/spark-wallet.nix
@@ -4,6 +4,19 @@ with lib;
 
 let
   cfg = config.services.spark-wallet;
+  dataDir = "/var/lib/spark-wallet/";
+  onion-chef-service = (if cfg.onion-service then [ "onion-chef.service" ] else []);
+  run-spark-wallet = pkgs.writeScript "run-spark-wallet" ''
+    CMD="${pkgs.spark-wallet}/bin/spark-wallet --ln-path ${cfg.ln-path} -Q -k -c /secrets/spark-wallet-login"
+    ${optionalString cfg.onion-service
+      ''
+      echo Getting onion hostname
+      CMD="$CMD --public-url http://$(cat /var/lib/onion-chef/clightning/spark-wallet)"
+      ''
+    }
+    echo Running $CMD
+    $CMD
+  '';
 in {
   options.services.spark-wallet = {
     enable = mkOption {
@@ -20,16 +33,33 @@ in {
         "The path of the clightning data directory.";
       '';
     };
+    onion-service = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        "If enabled, configures spark-wallet to be reachable through an onion service.";
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
+    services.tor.enable = cfg.onion-service;
+    services.tor.hiddenServices.spark-wallet = mkIf cfg.onion-service {
+      map = [{
+        port = 80; toPort = 9737;
+      }];
+      version = 3;
+    };
+    services.onion-chef.enable = cfg.onion-service;
+    services.onion-chef.access.clightning = if cfg.onion-service then [ "spark-wallet" ] else [];
     systemd.services.spark-wallet = {
       description = "Run spark-wallet";
       wantedBy = [ "multi-user.target" ];
-      requires = [ "clightning.service" ];
-      after = [ "clightning.service" ];
+      requires = [ "clightning.service" ] ++ onion-chef-service;
+      after = [ "clightning.service" ]  ++ onion-chef-service;
       serviceConfig = {
-        ExecStart = "${pkgs.spark-wallet}/bin/spark-wallet --ln-path ${cfg.ln-path} -k -c /secrets/spark-wallet-login";
+        PermissionsStartOnly = "true";
+        ExecStart = "${pkgs.bash}/bin/bash ${run-spark-wallet}";
         User = "clightning";
         Restart = "on-failure";
         RestartSec = "10s";