diff --git a/secrets/k8s-config/thelounge-gluetun.conf b/secrets/k8s-config/thelounge-gluetun.conf
new file mode 100644
index 0000000..935b015
--- /dev/null
+++ b/secrets/k8s-config/thelounge-gluetun.conf
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:Ku8RajaQy6evkJL3yH11nE9ryxqWbVFQqT/EBzRGXDsjIz9KvlBOa6FEU6cwBjdauCRrV6Xp4Mma6PYqEUxnBFIH9aWcVZyjkdDoTZzAcCFvSiu+gpdHuFbSG+mQakjqgSrZQc083J+9IacqT0rT6ISQVnNxwupEc6+3lxOvbfhVml8Piqa9KPVrG8sW94D4JO1vOuNQa7Eee0oto+zHZp4d+sVKT34qXq4POpbz7EkzQ8pc6e7zWpikrIsB8RlaeT+xSlHANs7EN0DQD0BULpx6ke25cWlJxvxEqPlBu7w0s7ixBKc4ZJFEVheI/5kMActcWfKGqy3MxSYT+aPcmlAoRjYkoV9zdAUjacNfcQcqZ6ldglRLupWJ9aFZaGLbd4Z3jB1Yw74qcJNP4iEXnOSy7K6tw5YVH1XGE+eDlkQGvFoIZnxmx4QylOrzhOFHy246n6mJdNcFwVlZX7OX/GDVb9giRrFrxzF/ExkAfIiLnXZDDA+tcC/Y2hM9coaKKYX1dbE5K2w455WSw8euv/tK4IWiGQ==,iv:dAD/yMjh43lYLbrmtlxy1Lf5AX7UapS+o5z6R6EFWmc=,tag:3hUNxmnJX58nU4PE0fQBSA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1k02u4z06c0qwen95uwk4qphns3qqujtmz57sr3ea34f2rwh5kvjsfkjrfy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjMktpaXFtTWRTd1dmSWp3\nZjd2akZ0cW5jRGtpaldoWXArdWt2empRTFZrCkNGNkh6MjlLak1pT0J5MmhiQjQ4\nei82aHp6bUp0THRVV1l4Zm13K2M0Wm8KLS0tIFlaR1h1Mi9NcXdXVGt2TkNwcHM2\nQmhjQ3d5M1h6QUh1dmh1dFE5bnp4SE0KoIL6Lu7P+cELoKXMxAnYooOSZcQ3lRp4\nzSFI6HkLeTYIWs7DXfHC0iqPURbWTh4H1HwKkq946utu5GFow0MTxQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age12ecq8rcc8s52e7nnzryjpafs73nzycp8jaa9z8s2gpnl5zn00a9q4u57nq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyUGZJOXRNa3ppc0IzU2No\nd2lnTjNqb0wzZ00wN0hZb0lONmprK0JVYjBRCjR3bW5jd01uN3lIYXlvOVJ4amxa\nSkh0aWZrSUpoMzJDbWtZeURnZGV2Y2MKLS0tIGM0ZThHYm9tTTdiZ0VTN1p3RFUw\nYjNKU20wWHgwcXR1alQwNjJ5R3NxZTQKtWwk2GtMVI17x6nP7qd74E4kCf/mJ0mH\nHxmgY1PriQ4dBXdhtPKrXNoDBpn1XPaa9ZsEAn3oYPPP5QRZlPLYDw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-06-22T06:09:08Z",
+		"mac": "ENC[AES256_GCM,data:IfNrffUIr7M77HS75+ZooJRuLHatB39qFipAxyJtDg7KzQi2cZGRNc/pCuChcRxmFY5WdVM40R3vV/ftfGkPZPmI0u/CBAF9kwLI5EiGpl6MidD4n0DYMyjYT+Rn4eSeRQ1op4MYO6wyuUAoFQg/ARtQ6cIkbsocn3kZb2wJGkM=,iv:x8vRc4J3ArHw5nC0NXccfqCdgv/q3xYgYlxI1TSLK+E=,tag:+iEmv6wZN35zwCJ+iROerQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}
diff --git a/venus/modules/home-manager/sodium.nix b/venus/modules/home-manager/sodium.nix
index 1f74103..e16474c 100644
--- a/venus/modules/home-manager/sodium.nix
+++ b/venus/modules/home-manager/sodium.nix
@@ -158,6 +158,12 @@
         sopsFile = ./../../../secrets/k8s-config/gluetun-vpn-proxy.conf;
         path = "${config.magic.absolutePathStrings.sodium.milky-way-secrets}/gluetun-vpn-proxy.conf";
       };
+      secrets."k8s-config/thelounge-gluetun.conf" = {
+        format = "binary";
+        mode = "0400";
+        sopsFile = ./../../../secrets/k8s-config/thelounge-gluetun.conf;
+        path = "${config.magic.absolutePathStrings.sodium.milky-way-secrets}/thelounge-gluetun.conf";
+      };
       # Private key the grand-central reverse-tunnel LaunchAgent authenticates with (its public
       # half is grand-central's tunnelKeys in milky-way main.jsonnet). Binary so the PEM round-
       # trips byte-for-byte; 0600 because ssh rejects a group/world-readable identity file.