diff --git a/venus/modules/home-manager/sodium.nix b/venus/modules/home-manager/sodium.nix
index ed6e84f..373c414 100644
--- a/venus/modules/home-manager/sodium.nix
+++ b/venus/modules/home-manager/sodium.nix
@@ -145,6 +145,12 @@
         sopsFile = ./../../../secrets/k8s-config/k8s-secret-values.jsonnet;
         path = "${config.magic.absolutePathStrings.sodium.milky-way-secrets}/k8s-secret-values.jsonnet";
       };
+      secrets."k8s-config/qbt-gluetun.conf" = {
+        format = "binary";
+        mode = "0400";
+        sopsFile = ./../../../secrets/k8s-config/qbt-gluetun.conf;
+        path = "${config.magic.absolutePathStrings.sodium.milky-way-secrets}/qbt-gluetun.conf";
+      };
       # Private key the grand-central reverse-tunnel LaunchAgent authenticates with (its public
       # half is grand-central's tunnelKeys in milky-way main.jsonnet). Binary so the PEM round-
       # trips byte-for-byte; 0600 because ssh rejects a group/world-readable identity file.