diff --git a/.sops.yaml b/.sops.yaml
index 84f8c60..6f1538d 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,7 +1,7 @@
 keys:
-  - &server_key age1zvuvrnh9fymw06e83n8y98ymg7jx6qn337893mejylcy948d4aesh7fufv
+  - &thinkpad age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
       - age:
-          - *server_key
+          - *thinkpad
diff --git a/flake.lock b/flake.lock
index acfc2f6..fb8e45c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -228,9 +228,30 @@
         "niri": "niri",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix",
         "wvkbd-src": "wvkbd-src"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "wvkbd-src": {
       "flake": false,
       "locked": {
diff --git a/flake.nix b/flake.nix
index b29223e..ee254b4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,6 +9,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Desktop/Shell/UI
     niri.url = "github:sodiboo/niri-flake";
 
@@ -33,7 +38,7 @@
     };
   };
   
-  outputs = { nixpkgs, home-manager, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
+  outputs = { nixpkgs, home-manager, sops-nix, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
     nixosConfigurations = {
       thinkpad = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
@@ -44,6 +49,7 @@
 
           niri.nixosModules.niri
           dms-plugin-registry.nixosModules.default
+          sops-nix.nixosModules.sops
 
           home-manager.nixosModules.home-manager
           {
diff --git a/home/programs/default.nix b/home/programs/default.nix
index 766d8ad..2191268 100644
--- a/home/programs/default.nix
+++ b/home/programs/default.nix
@@ -5,5 +5,6 @@
     ./alacritty.nix
     ./git.nix
     ./nvim.nix
+    ./zsh.nix
   ];
 }
diff --git a/home/programs/zsh.nix b/home/programs/zsh.nix
new file mode 100644
index 0000000..32e20e2
--- /dev/null
+++ b/home/programs/zsh.nix
@@ -0,0 +1,15 @@
+{ config, pkgs, ... }:
+
+{
+  programs.zsh = {
+    initExtra = ''
+      if [ -f "/run/secrets/vaultwarden_clientid" ]; then
+        export BW_CLIENTID=$(cat /run/secrets/vaultwarden_clientid)
+      fi
+
+      if [ -f "/run/secrets/vaultwarden_clientsecret" ]; then
+        export BW_CLIENTSECRET=$(cat /run/secrets/vaultwarden_clientsecret)
+      fi
+    '';
+  };
+}
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
new file mode 100644
index 0000000..8b5e01b
--- /dev/null
+++ b/secrets/secrets.yaml
@@ -0,0 +1,17 @@
+vaultwarden_clientid: ENC[AES256_GCM,data:MpSoam3ioiN0EaXjReSOjbKTSUwDfw2UoYldGd4GuU3+Mj3ZakzsQlw=,iv:VlgZg67Bia2IkuKtf8gPEx0rodZZ/3l9PKGEt26ihoA=,tag:yoC7AQoAa7TMJTaPObtN8A==,type:str]
+vaultwarden_clientsecret: ENC[AES256_GCM,data:RXxgt4N2bv74quQgLQ1hQsk03DwpZ9MNMZVyL3n8,iv:jBSREKIY9CraTLtwEltN2Cj2otwwWwpu4aanymWNYJA=,tag:6+z/PmGaf088urBq3TPgWg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUzZKTk1jSmpjYjhhQVJt
+            RVo3WCtqem5HWk5XdlF6YSt2czNoRVZ5VWhFCkV5ZExYVHNsZUpkcjlqQWg3K2Zx
+            dnpRYUFDdUtzd3Y5bHFFOVM4WmJRancKLS0tIEhuc0dyTFFGdThmQlozL0JYeWt0
+            Q0FvNkQwZGV2TmlQK1dTRXF4cWRZVW8K+QYGO6qJjzQKsaogR7OkUPLFVvKNMOc9
+            +KnFObbq/Axz3wfRBqFKWFnSeJ+L4j1UWpzAuwXqaPFoBrLlcRWNbw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
+    lastmodified: "2026-08-03T13:12:18Z"
+    mac: ENC[AES256_GCM,data:Rn5ihTmZg2nc7kBXUcaKg5Tlv0OgxadxL1Xh2FGI+FjZEBlhxBIPGGAXL8AlPZRoTIWofl3uUaeiP79p1TrAzaOxssM53cL39wpF2Zmk5YtdMM0Qks1Vtk7S+0QW97JoKESMFuzlBi7xmuhGKgCb8RHmleVa5WSvP2bcjOHpy8M=,iv:jKwVkaRwppHYoHSmeU8jE4NanNsirRqE1FWoCn+hLEE=,tag:L8aRqgkv56T4qA0h/JEjKg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/system/security/default.nix b/system/security/default.nix
index 2a7d354..cfb72c0 100644
--- a/system/security/default.nix
+++ b/system/security/default.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./sops.nix
     ./sudo.nix
     ./systemd.nix
     ./users.nix
diff --git a/system/security/sops.nix b/system/security/sops.nix
new file mode 100644
index 0000000..2a013d8
--- /dev/null
+++ b/system/security/sops.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."vaultwarden_clientid".owner = config.users.users.jashton.name;
+  sops.secrets."vaultwarden_clientsecret".owner = config.users.users.jashton.name;
+}