diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..e155600
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+secrets.json filter=git-crypt diff=git-crypt
diff --git a/flake.nix b/flake.nix
index 2c91da7..a916373 100755
--- a/flake.nix
+++ b/flake.nix
@@ -5,17 +5,20 @@
     nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
   };
 
-  outputs = { nixpkgs, ... }@inputs: {
+  outputs = { nixpkgs, ... }@inputs:
+  let
+    secrets = builtins.fromJSON (builtins.readFile ./secrets.json);
+  in {
     nixosConfigurations = {
       marauder = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [ ./marauder ];
-        specialArgs = { inherit inputs; };
+        specialArgs = { inherit inputs secrets; };
       };
       monolith = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [ ./monolith ];
-        specialArgs = { inherit inputs; };
+        specialArgs = { inherit inputs secrets; };
       };
     };
   };
diff --git a/secrets.json b/secrets.json
new file mode 100644
index 0000000..e4aa2b2
Binary files /dev/null and b/secrets.json differ