diff --git a/config/hosts/forgejo/forgejo.nix b/config/hosts/forgejo/forgejo.nix
index 2b2aea8..21e9269 100644
--- a/config/hosts/forgejo/forgejo.nix
+++ b/config/hosts/forgejo/forgejo.nix
@@ -61,6 +61,13 @@
         HOST = "redis+socket:///run/redis-forgejo/redis.sock";
       };
     };
-    secrets.mailer.PASSWD = "/secrets/forgejo-mailer-password.secret";
+    secrets.mailer.PASSWD = "/run/secrets/forgejo-mailer-password";
+  };
+
+  sops.secrets."forgejo-mailer-password" = {
+    mode = "0440";
+    owner = "forgejo";
+    group = "forgejo";
+    restartUnits = [ "forgejo.service" ];
   };
 }
diff --git a/config/hosts/forgejo/secrets.nix b/config/hosts/forgejo/secrets.nix
deleted file mode 100644
index 5c23295..0000000
--- a/config/hosts/forgejo/secrets.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys = {
-    "forgejo-mailer-password.secret" = {
-      keyCommand = keyCommandEnv ++ [ "pass" "mail/forgejo-nekover-se" ];
-      destDir = "/secrets";
-      user = "forgejo";
-      group = "forgejo";
-      permissions = "0640";
-      uploadAt = "pre-activation";
-    };
-  };
-}
diff --git a/config/hosts/forgejo/secrets.yaml b/config/hosts/forgejo/secrets.yaml
new file mode 100644
index 0000000..e4a1309
--- /dev/null
+++ b/config/hosts/forgejo/secrets.yaml
@@ -0,0 +1,25 @@
+forgejo-mailer-password: ENC[AES256_GCM,data:bFUrFyE/reeTtKZCrb1T1CG8Ng9QbDwZo9AdxU67i8uNmKcn93k3dqY70tSqBTAc9hpsXyW3UTKnPpk+ffb0mw==,iv:p16td5KV0rTmrrtX8FMojotEa+2oiFmVizkc6mt9QyI=,tag:czg/IlNLkx75m2iSddUkUw==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFNjVaNlFWeG9vMW4vM2R3
+        bWQyVk9jN1VkUUczbTBzUmdpZ2NyWlV4aVFjCmZwa0lDcXUzVDM4d1Mwa1B4Qm9q
+        WjVKMXJBRVNtc0JzcmE0Y20zdCtzM3cKLS0tIEJWanpwZHdPMGJiL0lkME9yVGQ1
+        a3ZvRGV3VENIbmlubG16MWF3SkdyQ00KZj5vuzVyCqbLH5gnQjhRpOfHtIB3RVZC
+        m+VdnnAFIfShrxwfOekVavffaHmG3PWS7RUKoeZNSdtz1ScuwfazPw==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYOEdadnQvSW1mcE9hSmFL
+        aFlqdHpTejNZRXJCbTh4WjQyQXVobitaa2hFCjV1RU9UOGlqaXhIckNLMmYwb0s2
+        eHY2VVpiQThzQUNuS1FLbFd3V2NGZk0KLS0tIGdOK3VEOUlNcldBQ1haRHhVS0cw
+        N3ZoNWlVK2trVkJLQlhnaHFueFdqVEkK800paYmP1opnW7o2V8f2zzWNR5tOVYGs
+        fl+SA7hE7uTpRrrGfuZq0jQgWOaeAbJ3+PzRuSrVlrXdWIyipcZM2Q==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1d5y8dx3e8pksvxr8fv8f02v0y7qg7kuwpxpmxksp7xlvrcpfju5sdz6guk
+  lastmodified: "2026-05-17T00:50:59Z"
+  mac: ENC[AES256_GCM,data:I3a9s9i6sFVTRQIAj94YZNyxQsDIWIvRhy9M/e6iMYpvoQyxFvMD3xAE0NQ1uX1QgMoi+6njTc8AmTXFJvSfoiqtVfHQH+HkLPMR27DZUY6kgZGMvUVswioSKfaF8fZxGEyWRPAuTDlynfOsGpr4Tqt5U8NBiYL1FDD6CPALaiY=,iv:RUbSPPTR6cTWwzvbnQRA/f9AjjjOpQUiEBrWvxqCpTQ=,tag:GcGsBgxWU/AXm06FkUI1LA==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.13.0
diff --git a/config/hosts/jellyfin/hardware-configuration.nix b/config/hosts/jellyfin/hardware-configuration.nix
index 764a903..f89a9e5 100644
--- a/config/hosts/jellyfin/hardware-configuration.nix
+++ b/config/hosts/jellyfin/hardware-configuration.nix
@@ -5,7 +5,7 @@
     fsType = "cifs";
     options = [ 
       "username=jellyfin" 
-      "credentials=/secrets/samba-credentials.secret"
+      "credentials=/run/secrets/samba-credentials"
       "iocharset=utf8"
       "vers=3.1.1"
       "uid=jellyfin"
@@ -13,4 +13,10 @@
       "_netdev"
     ];
   };
+
+  sops.secrets."samba-credentials" = {
+    mode = "0440";
+    owner = "root";
+    group = "root";
+  };
 }
diff --git a/config/hosts/jellyfin/secrets.nix b/config/hosts/jellyfin/secrets.nix
deleted file mode 100644
index 922d4c4..0000000
--- a/config/hosts/jellyfin/secrets.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys."samba-credentials.secret" = {
-    keyCommand = keyCommandEnv ++ [ "pass" "jellyfin/samba-credentials" ];
-    destDir = "/secrets";
-    user = "root";
-    group = "root";
-    permissions = "0640";
-    uploadAt = "pre-activation";
-  };
-}
diff --git a/config/hosts/jellyfin/secrets.yaml b/config/hosts/jellyfin/secrets.yaml
new file mode 100644
index 0000000..c4653bc
--- /dev/null
+++ b/config/hosts/jellyfin/secrets.yaml
@@ -0,0 +1,25 @@
+samba-credentials: ENC[AES256_GCM,data:9txZMLLwlyAMzI3Naag3tUD1zSXLAf/zoJFoJZYTChhmkPpuhuuaIANFcYmH2sUYSsvZLXlbBuLXRryjTix0zK9ZfkZW8/R1vg==,iv:cF3S9S2+Vk+VAb8gyFyxZ12fqmohHSD3GG0fTILrxRM=,tag:m4BqpUlKmUoPbXTEjFmjaA==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzb3dQYWM4SHVraHFPZEx6
+        aGpDcTEyVjZ6Y0h6YzM4aVliRXpqZFpLcnprCmNEOHFrby9IdEE1MTZIYWxrS3BS
+        ZHZTSmYxUW9pek5XblIyZ2FDVlV0TEkKLS0tIEN6NnErRXI3ejc3cVBiSVR6NlpC
+        a2tnWWxDaXgwQ3hmc0dreTNIRnl0cTAKCSaj/epLw16tVDX4OMCzutxlnARL8MDf
+        pUVDonkZ7sB7d1+mnyG+gMQuFDhiDcV9WS2h3M83xoSKoHnCkca9Ew==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlbUdFMlZvVXlzc3FPSmE4
+        Rk1jeUpDVUJMeUlJZDlYeHhwK2l6UkJNRVFVCjNUVS9ZMjI2ME9qTFM0Umc3dXZC
+        Z0todzhYSXZ5Yk5odUdOZGg3VnE3QW8KLS0tIGd1emhUMFVHT3JiZ1JhY0FWOU1i
+        cW9PWk9oRHZGeFlSdlVLSlJ6TVg4WnMKikUhDJNyuKdiazCUcKBo834NO3U6ZfjB
+        GbDn3wUKb465CDYw7GPcvZtM2mNufsoInZh+Oq/07Hi+seAXfX2y7A==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age10huhyn3va02zjysyanf8fd6lpfvjv3k3u6qymanz9jtcmfp3kqfskth7yt
+  lastmodified: "2026-05-17T00:58:22Z"
+  mac: ENC[AES256_GCM,data:0WF8JU4d+5nHHB5iBmqdS6TkZem2AHrYNx6zDm4yoIKip7ZVTfCPCyhZ4c3QseEBn1G2IXsTMEtIk6RVI2JigSJPLjyXOTJOeWjVtPD5+1I+mrU7z+YWN+sK5i4F1hQX7/E4JbTDh/h+NbqZ6I9pBq7Nm12QUtZdp/7R5qChXs4=,iv:DBdSDx/X8fh7SXiC073AtDMPDB9idKItzEz2fl7xe+g=,tag:0O1pZp6+Y2Uf2DlijwZLeg==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.13.0
diff --git a/config/hosts/keycloak/keycloak.nix b/config/hosts/keycloak/keycloak.nix
index 2ae957b..a069fd1 100644
--- a/config/hosts/keycloak/keycloak.nix
+++ b/config/hosts/keycloak/keycloak.nix
@@ -10,6 +10,13 @@
       http-host = "127.0.0.1";
       http-port = 8080;
     };
-    database.passwordFile = "/secrets/keycloak-database-password.secret";
+    database.passwordFile = "/run/secrets/keycloak-database-password";
+  };
+
+  sops.secrets."keycloak-database-password" = {
+    mode = "0440";
+    owner = "root";
+    group = "systemd-network";
+    restartUnits = [ "keycloak.service" ];
   };
 }
diff --git a/config/hosts/keycloak/secrets.nix b/config/hosts/keycloak/secrets.nix
deleted file mode 100644
index 984e9ad..0000000
--- a/config/hosts/keycloak/secrets.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys = {
-    "keycloak-database-password.secret" = {
-      keyCommand = keyCommandEnv ++ [ "pass" "keycloak/database-password" ];
-      destDir = "/secrets";
-      user = "root";
-      group = "systemd-network";
-      permissions = "0640";
-      uploadAt = "pre-activation";
-    };
-  };
-}
diff --git a/config/hosts/keycloak/secrets.yaml b/config/hosts/keycloak/secrets.yaml
new file mode 100644
index 0000000..a84ab28
--- /dev/null
+++ b/config/hosts/keycloak/secrets.yaml
@@ -0,0 +1,25 @@
+keycloak-database-password: ENC[AES256_GCM,data:2Jk0wskmlpdpaZj05MX4YRRDR75eAkk5eDNNOTSA9+dN8OGkUWdI0CX9ZdQFUB31GiRaLZQ4I9gwnIc2sIxzuA==,iv:4fq+safzIGC21NFTaHsIfgZwuKelQyxttEeW7Pp09v8=,tag:c7LO34hJqi1yEwQ+cQc0Dg==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArR0Y2ZVg4S1FDYmRlS0xL
+        VWlJVzNvdHVXanBMN043QjcxVjd5bFk5d21JCnVzYVcwT2tnQS9jblhVQUFaNWZD
+        L0owQ1hhUFdhNVAzaVJNbWhQaEdXZlUKLS0tIFZFOFpKUklKNVJFRS9ZY1JaeS9D
+        RnF5YjRmbXRaY3h1MU5PWEZETGh0N2cKIwZg6mMY8c3VpE9hAk9bcFXLyzl7J/4M
+        BIh7C+yZbD7bL92TEP3gTpW+EsGiJl2LCq7NVVuDkboYuJ6kAqLppg==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGS25mcEErQ1pUMTV6U1h4
+        WXduajlyTFFncXdhZ09BdXg4amV4V0xMalFNCm85dk1ldUlHTytXRDJLcjIyN2M2
+        ZmVFVG1YcWhnTmwySmFRUDhEMkVyb1EKLS0tIHVDVkc3QytPU3pQTWxMSG1TRFdI
+        LzVUdGUrZmVTa1RqRHNWaFFhY09ySEUKFrN7X2ir3gwL/S91mychdjXi2oBPEPr9
+        aizXtIk0JX6SzrP/Oy0mYROeEEEUfPVBBypEUlBjlyeSyathmEoVLQ==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age15kluaw2krucmc0j98zfk0s5tkwqer0ax6jva458zukzrgnqjqc9q7s88yd
+  lastmodified: "2026-05-17T01:07:49Z"
+  mac: ENC[AES256_GCM,data:fAOsq2jrl8dTvQSn+Cp0sxuU5AuOdnm97LBIyPY71KbxMAY0vn/RDvhszvskMIE25JWGuZROnFoYmrkUqSp/pxG9gvcPQ6keW9WMr09YFli4u1tvADl6Ag+OkcgDe2UP1aPRkW6i7sGpq7Wfv/3G8HNMLgywhyiAA2XICymbDBI=,iv:ChOk26gheG2ErLVqt/rrMw1MxuOmEA595fay6pGUCcc=,tag:8wGA4YZa+ZyNDIBz/d1DUg==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.13.0