diff --git a/modules/nix/sops.nix b/modules/nix/sops.nix
index 36f5725..bb2c08f 100644
--- a/modules/nix/sops.nix
+++ b/modules/nix/sops.nix
@@ -8,6 +8,7 @@
   defaultConfig = {
     defaultSopsFile = "${self}/secrets.yaml";
     defaultSopsFormat = "yaml";
+    gnupg.sshKeyPaths = [];
     validateSopsFiles = false;
   };
 
diff --git a/modules/services/crowdsec.nix b/modules/services/crowdsec.nix
index fbfe726..ef8b8fa 100644
--- a/modules/services/crowdsec.nix
+++ b/modules/services/crowdsec.nix
@@ -108,6 +108,16 @@
     inherit (lib) mkForce;
 
     dataDir = "/var/lib/crowdsec/data";
+
+    setupDeps = [
+      "postgresql.service"
+      "sops-install-secrets.service"
+    ];
+
+    setupUnit = {
+      after = setupDeps;
+      requires = setupDeps;
+    };
   in {
     imports = [self.modules.nixos.crowdsec-base];
 
@@ -150,42 +160,24 @@
     };
 
     systemd.services = {
-      # keep-sorted start block=yes newline_separated=yes
-      crowdsec = {
-        after = [
-          "postgresql.service"
-          "sops-install-secrets.service"
-        ];
-        requires = [
-          "postgresql.service"
-          "sops-install-secrets.service"
-        ];
-      };
+      crowdsec = setupUnit;
+      crowdsec-setup = setupUnit;
 
       crowdsec-firewall-bouncer-register.serviceConfig.RestrictAddressFamilies = mkForce [
         # PostgreSQL local socket access.
         "AF_UNIX"
       ];
 
-      crowdsec-setup = {
-        after = [
-          "postgresql.service"
-          "sops-install-secrets.service"
-        ];
-        requires = [
-          "postgresql.service"
-          "sops-install-secrets.service"
-        ];
-      };
-
       crowdsec-traefik-bouncer = {
         after = [
           "crowdsec.service"
           "sops-install-secrets.service"
         ];
+
         before = ["traefik.service"];
         description = "Register Traefik CrowdSec bouncer";
         requiredBy = ["traefik.service"];
+
         requires = [
           "crowdsec.service"
           "sops-install-secrets.service"
@@ -215,18 +207,14 @@
         serviceConfig = {
           DynamicUser = true;
           Group = config.services.crowdsec.group;
-          LoadCredential = [
-            "traefik_bouncer_key:${config.sops.secrets."traefik/crowdsec_bouncer_key".path}"
-          ];
+          LoadCredential = ["traefik_bouncer_key:${config.sops.secrets."traefik/crowdsec_bouncer_key".path}"];
+          RemainAfterExit = true;
           StateDirectory = "crowdsec";
           StateDirectoryMode = "0750";
-          RemainAfterExit = true;
           Type = "oneshot";
           User = config.services.crowdsec.user;
         };
       };
-
-      # keep-sorted end
     };
   };
 }
diff --git a/secrets.yaml b/secrets.yaml
index f62ef67..4029e2d 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -50,6 +50,7 @@ traefik:
     crowdsec_bouncer_key: ENC[AES256_GCM,data:NogMDioHUe+mKwtpCwF5xhABv9asVg0bbTx5yIVucb5g5OHWD2BO2dykWsg=,iv:cmnFSJXvNStbARyBKNeUdoV/OG04wqQBLYRfn/zXiFA=,tag:nk9+Fr69pl6ciROtBe/Vvg==,type:str]
 authentik:
     secret_key: ENC[AES256_GCM,data:YxLwQVyVSA3bh6UsYRc8jkI/Ff0Jjqt2cfVyVovTfiyR8vgivpppR2sKq8Q6J1E4rDSL83N3iqU8/wTZKrHhnjyebpcl4oqo6RYIiEx80fU=,iv:RIb84Gic36jzBgOuu55nwBr54AoSO8690VuW0mYHvY4=,tag:iKFjHaz3SVgSNkKQrcM7uQ==,type:str]
+    proxy_token: ENC[AES256_GCM,data:C5IgKA==,iv:E2DAqCShKi9jKLZS+9FpSCikP3uBMG54aCVQRfhbMEA=,tag:kAJIFKeiQAMlKk3Kbwz72w==,type:str]
 sops:
     age:
         - enc: |
@@ -88,8 +89,8 @@ sops:
             w2ToACYVigKMSlqPNG9bKcK75XI/iAONG48DQm1Nse3yB9/q3jwd+Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1yl52c6aemw9anmfuqayamvsnkvlu6fmy0kk3gzvrraexxd9pr90qvs8pe5
-    lastmodified: "2026-06-06T20:51:26Z"
-    mac: ENC[AES256_GCM,data:bD/W1n0gGHtzn+mX+Hz8mv61uTvcH3SXGnPWHk5AWMqKLhrNM5cmEiGxVp8idb8OBerB60TvFsrULLJ3IATsHJPep/gtrDeC/O2R8DDOxgfYZu+I2Io8IrgIiFaaFh7yZsKrO2vbrlqBj1WzEfKjQ0oUvUwgJoBvwZFvSrlPi+w=,iv:6146XWaPlxzcYUidSfyjAHaqJEpxyAHfREVnlUonsbM=,tag:Rnb01bq6crQXJOgQTz9kLA==,type:str]
+    lastmodified: "2026-06-07T01:19:03Z"
+    mac: ENC[AES256_GCM,data:H9JOKTDytwpmsKatLIertu4SP5zgzM3/hUMByWDyynNoSZT9NZubtvcfs/k3qim1YAt8gfpqYAizw5R1rcJ+kd1G36oEtI58jaXnTLyYGB2zLWBSnjCObyX3MVg7p7emqDZvNdc5nv2B45Kgovfqwg6d3qWbu+LYyzeIssV99+s=,iv:aH9MAySG/+K1DQlG9TmIKxLoow5ASz5NNYKVOHIhUqA=,tag:fKSJQmtJSRssJxuzWcXqOw==,type:str]
     pgp:
         - created_at: "2026-06-02T01:50:38Z"
           enc: |-