diff --git a/.sops.yaml b/.sops.yaml
index f36b9bc..8ab7af5 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -44,4 +44,12 @@ creation_rules:
     - age:
       - *main_pub
       - *venus_1p
-      - *tilderef_root
\ No newline at end of file
+      - *tilderef_root
+  # yutobot-discord's .env (binary blob), consumed on sodium by sops-nix for Tanka -> a k8s Secret
+  # (milky-way/lib/yutobot-discord.libsonnet). Same recipients as the k8s-config secrets: the admin
+  # key + sodium's venus-on-1Password key. NOT tilderef (unlike andref.yaml) -- it never runs there.
+  - path_regex: secrets/discord/yutobot\.env$
+    key_groups:
+    - age:
+      - *main_pub
+      - *venus_1p
\ No newline at end of file
diff --git a/milky-way/secrets.libsonnet b/milky-way/secrets.libsonnet
index 701fd5f..ee2c65b 100644
--- a/milky-way/secrets.libsonnet
+++ b/milky-way/secrets.libsonnet
@@ -28,4 +28,7 @@
   'gluetun-vpn-proxy.conf': importstr '/Users/yuto/.config/sops-nix/secrets/k8s-config/gluetun-vpn-proxy.conf',
   'thelounge-gluetun.conf': importstr '/Users/yuto/.config/sops-nix/secrets/k8s-config/thelounge-gluetun.conf',
   'kubo-gluetun.conf': importstr '/Users/yuto/.config/sops-nix/secrets/k8s-config/kubo-gluetun.conf',
+  // yutobot-discord's whole .env (binary secret under discord/, not k8s-config/); rendered by
+  // sops-nix on sodium at <secrets>/discord/yutobot.env. Consumed by lib/yutobot-discord.libsonnet.
+  'discord/yutobot.env': importstr '/Users/yuto/.config/sops-nix/secrets/discord/yutobot.env',
 }
diff --git a/secrets/discord/yutobot.env b/secrets/discord/yutobot.env
new file mode 100644
index 0000000..9e24a9d
--- /dev/null
+++ b/secrets/discord/yutobot.env
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:1QAHmXbxp/54PueZYpR8MhVr4An7cBZKdqmYNlmkXf1gJmWsvs4PPv2XeMRx9KnU/ZpkEoAcivYS0kAzfQmW/kNkdPelJCMveTvbkYRddIEYkfT5PlFX4F9LFRVhKKsQB6lbR6seNSM1LaIKleMIBhO2FaghiyT8sZ7yi6nLDm1IY2mWibwUukWNcbR9mwMo9XGGt2Nxu90c/3xtd8+8OkdCXq6x/j0HyEYhn0d3CvcR98fW1iGGGvK92loGqw0VWOavOEb5ikTPBV5SITLLYbBfRfwaWR8apanAfXxqS/4GeKtWiqA6tivrt1StKJufPCk0zIjpySD2QNlspYrV59xXaT21XgTjLCUJXwwb7ByfL6uBg7jyWgGNQsgN1QyydnDiqog8PYuYdC1tBKbhOq852Nb+lEZsQL/cGYwaZr5Q106Sdb6tNZ2lmDNDPVB9CksgNeCUG1eVWcXGK+dMjIstD2pTa+T/j/Jo9iyY0V3tV4wbIuQ2cnPkpgJN3Rllek4CyaCBC5GvAQpMKDXOs/AmqvApsBna28viaRG9aYPO2Q57F9O4nTtqJzA8iS+Xu0m4eGDbYzpNGeYSOFnMmQ++gHd5LJX+bFXMNFn06gDNz5falYrg5M5lhdki+BUjjkTEOre2AFSwP0LT7g9tU1su46BdW07nkmr+uJCPSL1/30ds0qrP3+aXxO0q1N8WYkmtp9g13gJuG+J0thrtRgmjQu99LSpSvsMO414xw8PNjUkufeB+Oa75sZI31bTb1z3Z,iv:ysyjvGlId//S21FMlxJuiAeGhiiclwDvE6fCACRCjg4=,tag:ltopwOCXLL4hkxqgOrY6kw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1k02u4z06c0qwen95uwk4qphns3qqujtmz57sr3ea34f2rwh5kvjsfkjrfy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcnFBcXY4NFdDM1J4NG90\nT25uRWpzOVk2UUpvWUN5d3B0SzgzK0d1VmpzClc1Ulk2aExBYUJRYWlpeFdxeGto\nNHgvV0k5d2hnNmhLM0xmRzNyMzFGYUkKLS0tIEtxbzhwN2s4QTRneTJwQ016T1BW\nOXRqcG93UjB3Nll0ZER2QlNEU25qRDQKH3hiypZHGiYhQ5ABpserkj6Zcc9P7Ety\n8e/k7zx05XZRAIPmiGQGrZZEyfY2s8tQ9g/k7BMOpwRYcEtBzOtnZQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age12ecq8rcc8s52e7nnzryjpafs73nzycp8jaa9z8s2gpnl5zn00a9q4u57nq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcWY0bVBGbEpxK2hDSGtI\neDQ5Mkg1YmkrSWlRN1F6Q1VjcU1wUXpCazNZCjZ4YmdTcGlqZmp5cTZnUjhNelRK\nNTE1Y2I5SWZtdVY0SzFZcWs0V1JmcXMKLS0tIHlWdXd4QXN5N3Y2cnJ1TElHTFRy\neTU1RzQ5dE5TNmZWY0JNS29CMUFxbW8KuvLPWtNFIiVKZ4yaA+58YKtmt+XHTCP5\nlQpuEVAuFHzYYdhx4FSA/CSQ/hK7O8WZocXT4ZxZc89jz64C9EV+uw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-09-06T04:49:52Z",
+		"mac": "ENC[AES256_GCM,data:5go3QSpO+ZjvB/l2lsXgRhS52Ba2sc5hhfS4eh/lS85/gP1I/kNIkKmwGryDO1Lg0ah8e+ARLSolBhihjsaaywJedmcqasFFn+3E7F0tH3l1eYWsabOdhYNschNzAbRP0FkW/6udugIkTBrtk0ilVxPp8i2zIm5msGHvI+9i5ps=,iv:m5tx323kmd3yMpEy4I0N/VDar6YPczCDvy1wRR7LECU=,tag:AqXMEZF2drRK+/SyBistTA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
diff --git a/venus/modules/home-manager/sodium.nix b/venus/modules/home-manager/sodium.nix
index 94472a0..041c021 100644
--- a/venus/modules/home-manager/sodium.nix
+++ b/venus/modules/home-manager/sodium.nix
@@ -170,6 +170,15 @@
         mode = "0400";
         sopsFile = ./../../../secrets/k8s-config/kubo-gluetun.conf;
       };
+      # yutobot-discord's .env (whole-file binary blob). No `path` override: sops-nix renders it at
+      # the default <secrets>/discord/yutobot.env, which milky-way's secrets.libsonnet importstr's
+      # into the k8s Secret (milky-way/lib/yutobot-discord.libsonnet). Same rationale as the
+      # k8s-config secrets above -- don't add a `path =` that would move it out from under that import.
+      secrets."discord/yutobot.env" = {
+        format = "binary";
+        mode = "0400";
+        sopsFile = ./../../../secrets/discord/yutobot.env;
+      };
       # Private key the grand-central reverse-tunnel LaunchAgent authenticates with (its public
       # half is grand-central's tunnelKeys in milky-way main.jsonnet). Binary so the PEM round-
       # trips byte-for-byte; 0600 because ssh rejects a group/world-readable identity file.