diff --git a/.gitignore b/.gitignore
index bd38c85..8cf8c1c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,6 +28,7 @@ result-*
 !/secrets/nextcloud-smtp-pass
 !/secrets/forgejo-user-token
 !/secrets/smartd-smtp-pass
+!/secrets/meilisearch-master-key
 
 # 2.1 will need to re-auth on 29 May, 2026 as per Tailscale maximum 90-day window.
 !/secrets/tailscale-auth-key
diff --git a/.sops.yaml b/.sops.yaml
index 4fc6170..8a6008d 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -27,7 +27,7 @@ keys:
 creation_rules:
   # ── Secrets available on all machines ──────────────────────────────────────
   # ── Server-only secrets ─────────────────────────────────────────────────────
-  - path_regex: secrets/(pds\.env|cloudflare\.token|cloudflare-acme\.env|cloudflare-acme-croft-click\.env|cf-tunnel\.json|forgejo\.env|nextcloud-admin-pass|nextcloud-smtp-pass|vaultwarden\.env|sharkey\.env|meilisearch-master-key\.env)$
+  - path_regex: secrets/(pds\.env|cloudflare\.token|cloudflare-acme\.env|cloudflare-acme-croft-click\.env|cf-tunnel\.json|forgejo\.env|nextcloud-admin-pass|nextcloud-smtp-pass|vaultwarden\.env|sharkey\.env|meilisearch-master-key)$
     key_groups:
       - age:
           - *ewan
diff --git a/modules/server/sharkey.nix b/modules/server/sharkey.nix
index 4c48345..91c3f7a 100644
--- a/modules/server/sharkey.nix
+++ b/modules/server/sharkey.nix
@@ -49,19 +49,20 @@ lib.mkIf cfg.services.sharkey.enable {
   };
   users.groups.sharkey = { };
 
-  # Meilisearch master key — file must contain: MEILI_MASTER_KEY=<value>
-  # Generate: openssl rand -base64 32
-  # Then: echo "MEILI_MASTER_KEY=$(openssl rand -base64 32)" | sops --encrypt --input-type dotenv --output-type dotenv /dev/stdin > secrets/meilisearch-master-key.env
-  sops.secrets."meilisearch-master-key.env" = {
-    sopsFile = ../../secrets/meilisearch-master-key.env;
-    format = "dotenv";
+  # Meilisearch master key — file must contain the raw key value only (no KEY= prefix).
+  # Generate and encrypt:
+  #   openssl rand -base64 32 > secrets/meilisearch-master-key
+  #   SOPS_AGE_KEY_FILE=~/.config/age/keys.txt sops --encrypt --in-place --input-type binary --output-type binary secrets/meilisearch-master-key
+  sops.secrets."meilisearch-master-key" = {
+    sopsFile = ../../secrets/meilisearch-master-key;
+    format = "binary";
     owner = "meilisearch";
     group = "meilisearch";
     mode = "0400";
   };
 
   services.meilisearch = {
-    masterKeyEnvironmentFile = config.sops.secrets."meilisearch-master-key.env".path;
+    masterKeyFile = config.sops.secrets."meilisearch-master-key".path;
     environment = "production";
     listenAddress = "127.0.0.1";
     noAnalytics = true;
diff --git a/secrets/meilisearch-master-key b/secrets/meilisearch-master-key
new file mode 100644
index 0000000..cc11a26
--- /dev/null
+++ b/secrets/meilisearch-master-key
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:Py8U65PWF5ZGHsYg422Brew/dhaMcqIK5XqY5UFezxJZe+IDvbnY4vfyevvM,iv:kRhELm5RZ5wL3fFPUPz+kizNYUmQSXSpK1PcmdZrwSg=,tag:D3Rxp2mxUWFcuepSA0iUzg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age17ulnk7akn9zfwtc87vsexrr809xj6gkkcp2rkez6xtzyrqclpshqfew5wy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyU1NiU2lCcGxFODZZYjJ3\nbG0zYTlONXZzRi9jRFFIVUJzcnhFeWpSMFZNCkdOa2VkZHE3ZWFqOUdueEZGdnRp\naDBQRzQ5b2xmcVdaNzN4VHFkTGNDNVkKLS0tIEtnMUpXbWZaM1N0WDY2YlVhWlZu\ncExoM2dDZXBpV0NRSHdiZzM5b3lVamMKgciQ2Y2lk+/xJ+KUVfazRsvet/R3gAlc\n1Y+P7p8dTuSPfV+uPJVuRKraKHQZ4fR0If+mt6AJ0/rLHZ0/AL4GSg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1xvny7h8cahajamj4lz9cew5w0dqlge0yy6tys7szj42grcrl95jqsrutsu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvbHoycUkrRjFYL3dGWUVJ\nY2padjROSzhKZzROSE8vUk1wQ1hxQ3V3eWxNCnZNSWtRZzVPTUdGSDRvNGRYWWtr\nZUd1ZFVDYzAyT3NmdlFJY0JCZU5Da0EKLS0tIDVqSWJGem94Wm5TRm43MzVmdzBN\nTDNIaHY0TVVKRjFkV0JRakJTUE9DYXcKzZtvXXH9r+HoVT5oGXkzdsDQcE3LYFa6\n5jfk5G87i5Tz9De1LPu+sNR/DoSS18Tu1xgosFMr5KRvgYchhkcfcg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-20T21:06:11Z",
+		"mac": "ENC[AES256_GCM,data:Q/OyXakVtwRQxZ+oQZR30XXkQyfbGZZTc32PrM7llcLxt/q31ar0f+0F3Lav4eSkE+MHN2RZMx6+OW8jG4w2RCnLe4+hQbKvH7ZWEBukgXHvjHeu0Cv054f8ppe6ixmx5xzrQnIdLpT0vBBpvyDxKx6UiqIU1dBdmajP+P+BBXg=,iv:6QQhpbtWwpsWABhX5x1MdNhBt7aXtl2dI7T3vu6kyO4=,tag:6xGEAA6aSoFIRrMlVl60RQ==,type:str]",
+		"version": "3.12.1"
+	}
+}
diff --git a/secrets/meilisearch-master-key.env b/secrets/meilisearch-master-key.env
deleted file mode 100644
index edfbb3a..0000000
--- a/secrets/meilisearch-master-key.env
+++ /dev/null
@@ -1,9 +0,0 @@
-MEILI_MASTER_KEY=ENC[AES256_GCM,data:6CDrCEr3HQjJd+Bkg7axzP91lRyYGPfFVJ9AVsJsmYD5lpnn3qzXk9DTjYU=,iv:k31bulPpARGM6BFv0ZZEPW7V6TS45Foremw69JqcGjw=,tag:C4jScN9fLQLry/Ni5t0OuA==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2K0ZRR2p3em9aTCtFeHRV\nMDA4elgydzRuM1RDRjV5c3MwTHlaQlhWV1JvCjgraFdoek14Wlg0Zi9SbVNhRmw1\nODdrVmN0S2QzVyszOUdDallramswcDgKLS0tIERxRitnUFdOa2pUeFlBeTg4RmY0\nbHM4OXJZamtNRmZ4dERDYVZRcXNFQ00KX2Nn5bHwG373Df8wDZ+vyzSEeQd33BUA\nhsbyesskF3Pv9nBC+We1pTAtPNMENkNJsTNUrGVXUtkFXUZesWHbRQ==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_0__map_recipient=age17ulnk7akn9zfwtc87vsexrr809xj6gkkcp2rkez6xtzyrqclpshqfew5wy
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxYS9NdFhaNnJVTU5RS09B\nRndKTTRKSWw0ZHlUaFdHcHQ1eHhnMGZnbW1rCm1xVEZSQjN6MEplNmhJZms4VFpr\ncWpuMmZjQmVIdnFlUTdjdS9nK0tBNDQKLS0tIFY4VkM5TkMwdm0zelZxRVZraHl5\nMmRUTmY3RTE0NjFuejEwN2pSUU5veXMK6rRQIiVTBTDJ4woAAW3ngu4cWYAJ5PCO\nCtTTavbig2b14KihWRufbKYYlyIlOrfKHVyzH55kjISLvFwnlVl4MA==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_1__map_recipient=age1xvny7h8cahajamj4lz9cew5w0dqlge0yy6tys7szj42grcrl95jqsrutsu
-sops_lastmodified=2026-03-20T21:01:36Z
-sops_mac=ENC[AES256_GCM,data:mIJm2VhsN001/+6D9JlEtGfaDbcVU9ixIm9wThVTF0nluyeoj7KdBAoIKeFS38FmEzCKlUUpoKyuDn13OO2wDW6kBIWNJVrBH6cjBpGQP5ESO4nhjJ6BlOeCHPdyLbhiIRmS9CgUFrevMPVYiPB+BJDANi1CT50/IAt9XCJcIeQ=,iv:+yP4JHMd2jfVtews/l3dDdGvFqDoF/yEy2PK7Yn4N14=,tag:mfVx0B18Qer+2uJjZvSz1A==,type:str]
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.12.1