diff --git a/modules/services/immich.nix b/modules/services/immich.nix
index f82ef09..28abfe3 100644
--- a/modules/services/immich.nix
+++ b/modules/services/immich.nix
@@ -144,6 +144,22 @@ in
       default = 2283;
     };
 
+    publicProxyEnable = mkOption {
+      description = ''
+        Enable Immich Public Proxy service for sharing media publically.
+      '';
+      type = bool;
+      default = false;
+    };
+
+    publicProxyPort = mkOption {
+      description = ''
+        Port under which Immich Public Proxy will listen.
+      '';
+      type = port;
+      default = 2284;
+    };
+
     ssl = mkOption {
       description = "Path to SSL files";
       type = nullOr shb.contracts.ssl.certs;
@@ -502,6 +518,12 @@ in
       };
     };
 
+    services.immich-public-proxy = mkIf (cfg.publicProxyEnable) {
+      enable = true;
+      port = cfg.publicProxyPort;
+      immichUrl = "https://${fqdn}";
+    };
+
     # Create basic directories for Immich
     systemd.tmpfiles.rules = [
       "d /var/lib/immich 0700 immich immich"
@@ -550,6 +572,8 @@ in
             resources = [
               "^/api.*"
               "^/.well-known/immich"
+              "^/share.*"
+              "^/_app/immutable/.*"
             ];
           }
           {
@@ -572,9 +596,15 @@ in
     ];
 
     # Allow large uploads from mobile app
-    services.nginx.virtualHosts."${fqdn}".extraConfig = ''
-      client_max_body_size 50G;
-    '';
+    services.nginx.virtualHosts."${fqdn}" = {
+      extraConfig = ''
+        client_max_body_size 50G;
+      '';
+      locations."^~ /share" = {
+        recommendedProxySettings = true;
+        proxyPass = "http://127.0.0.1:${toString cfg.publicProxyPort}";
+      };
+    };
 
     # Ensure services start in correct order
     systemd.services.immich-server = {