diff --git a/secrets/k8s-config/gluetun-vpn-proxy.conf b/secrets/k8s-config/gluetun-vpn-proxy.conf
new file mode 100644
index 0000000..7a102c6
--- /dev/null
+++ b/secrets/k8s-config/gluetun-vpn-proxy.conf
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:M1ltJrW9rs5aN6vizqHLT751KGGi8beOUPrBUU3x6CxJN5tEUzdw68KLNlieNSpcHjonohSayAVj8As68upIPJmDpcXV+unpp1xCLOWAgxmFO58If0fgX9t4yTzdV0aUz1QwgxRXHysVfy+QOW9+djeCRQNl9Gi8f/pukIGXZl+2O1sRL+K9xRCrCt5id5KDqWr7sXBMLYCrVyPdHnfaAVFT7j/qUI+GcnATTJXUpHmv5ywU9ixGeRu51/DEtvWoMhELtEysqndII/k8IvDB6m7R1GqWxJHX2oOty/CxvZNq7En5VQtueyJIrUPMwGZ4AKeCbWeKy5ppAJK5EgV4wChLiSQoNH0ogFquNOzvpDjD9n6gKnvr38n0q5tO6DAnnTapo5F3q/Nd/h4i6vVy/LgoTkf1XoPX9fnufwyO3S6Kyb2rEUMRpwkibRiDPMtupTzKbjfleB26MIAbxHoKhcXj1hzY8TYrlJaOj9v618tdiqBEDQi3Cr1WY3Kh9CrJLbygCr7fSMuBMqi50z6e1BcmMxY+ORKZ0/LPISCvrGqEaj2pYjWjVtuk064ywulV7mJsKz5rJCiS9NUxE1kCfH6wizS22A2c+3af3q8gKNNxXW2fpM3djs9f7nNma/X0+8zEKMlvQrhbiCewujHPTUzzyRocaECrTHFUQjnUgqchnG3g654HvTZekoWWlbH5jfGxjPAl3ZjtHPZqb4XU4WUsfg0bByM5lwnhAU2ySk8K6zCzdN4jDfPCk2ulxqyZ/Q==,iv:cFX0UfDKfQxxbxXVjL7OtD8SCP4mz019lbWnPMBpyjY=,tag:9blgi0EHptfjaWzNWQGRjA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1k02u4z06c0qwen95uwk4qphns3qqujtmz57sr3ea34f2rwh5kvjsfkjrfy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4dzAwcUh5bmV2V1FMb1I1\nMTQ4UUVyY2E1SGFwYzk3Z2RjY1ROaWRGcEJ3CnpodkE5QlV4cVcxOGhURmZCSHNs\nRUhXUFE3K1JyOWtnNHBSTFBsTjVBRzAKLS0tIDRLUWhDNmtuZ2U4Z2p5TXUxdnQz\ndVowNVhUczNUOHhVaWJmZUI4bjBWb1UKdQlgrGZw208LVTIV1TVSe+UWw3psbH1P\nnbnijYHYGXxBU64GVjKGP1Gf1F4JxZpR2iPHHSibZIfJis5ww6fQ0Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age12ecq8rcc8s52e7nnzryjpafs73nzycp8jaa9z8s2gpnl5zn00a9q4u57nq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1cjg1UDZqbVhmU2UrRkMv\neUhiWVpLYzlWR1p3NHI2MS85Y05qQkdqUWxrClU2MXJBV1gyeUFGclNoZzYvMHpn\ndi8wTHZUenBuQkxQUXRjcHZyb0U3MjQKLS0tIDg1NlFVYUNKRTJoekdQZGNYNnhh\nK1hZZVhINXNQM2Y2VnUvZDJjaU5QZ2sKQoW9HL07ZDvWNTTOx/yNZvV0b13tER0d\nPs2E6kqSrk3UTySx8IbfwOre2aOzxIwJGYrS90zaUfMLBwlm08hHJA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-22T03:28:32Z",
+		"mac": "ENC[AES256_GCM,data:YQ0xtkxyGFJTP4ZXnctgJ7jDWlz31V2TFcBs4r4RQDuXFaouUJB0daDAO7aJcuHYuG46nqAHFcgCpCWfM/GxJFz/64I3lGOq81iW5wE39u3UroDk41UZSY7FQQgBSqqRZGOgMWibMNfNTzPDBufA8aI9L5XPLK4Gpt50ZqhnLhA=,iv:/1vJruHE48UQx+ptHcgyuA9008qccy0EwZ3l6GGl4rg=,tag:gHTvti+TPw7JXZAdtBzMLQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
diff --git a/venus/modules/home-manager/sodium.nix b/venus/modules/home-manager/sodium.nix
index 8a50556..1f74103 100644
--- a/venus/modules/home-manager/sodium.nix
+++ b/venus/modules/home-manager/sodium.nix
@@ -152,6 +152,12 @@
         sopsFile = ./../../../secrets/k8s-config/qbt-gluetun.conf;
         path = "${config.magic.absolutePathStrings.sodium.milky-way-secrets}/qbt-gluetun.conf";
       };
+      secrets."k8s-config/gluetun-vpn-proxy.conf" = {
+        format = "binary";
+        mode = "0400";
+        sopsFile = ./../../../secrets/k8s-config/gluetun-vpn-proxy.conf;
+        path = "${config.magic.absolutePathStrings.sodium.milky-way-secrets}/gluetun-vpn-proxy.conf";
+      };
       # Private key the grand-central reverse-tunnel LaunchAgent authenticates with (its public
       # half is grand-central's tunnelKeys in milky-way main.jsonnet). Binary so the PEM round-
       # trips byte-for-byte; 0600 because ssh rejects a group/world-readable identity file.