diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index 5264833..0b61aa0 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -40,6 +40,7 @@ in
             };
           };
 
+          # Bring in secrets and smarthost credentials
           environmentFiles = [ secrets.tranquil-pds.path ];
         };
 
@@ -60,25 +61,30 @@ in
 
           virtualHosts = {
             ${hostname} = {
-              # by default, tranquil runs on port 3000.
-              # You can change this with the tranquil-pds.settings.server.port option in the service config.
               extraConfig = ''
                 reverse_proxy localhost:3000
               '';
             };
           };
         };
+        systemd.services.caddy.serviceConfig.EnvironmentFile = [ secrets.caddy.path ];
 
         sops = {
-          defaultSopsFile = ../../secrets/pds.env;
           secrets = {
             tranquil-pds = {
+              sopsFile = ../../secrets/pds.env;
               format = "dotenv";
               key = "";
 
               owner = user.name;
               group = "wheel";
             };
+
+            caddy = {
+              sopsFile = ../../secrets/caddy.env;
+              format = "dotenv";
+              key = "";
+            };
           };
         };
       };
diff --git a/secrets/caddy.env b/secrets/caddy.env
new file mode 100644
index 0000000..cdb37b4
--- /dev/null
+++ b/secrets/caddy.env
@@ -0,0 +1,10 @@
+AWS_ACCESS_KEY_ID=ENC[AES256_GCM,data:vC+9u2FJQYjG7Y7cakl9v3YjSgk=,iv:/HauLg03FpMOmJWRtyP5gAFbgPHWegu+FqnfyOcRjgU=,tag:bJTTg5Hcr+RtuhgkKuq5wQ==,type:str]
+AWS_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:oonLTo6xOrogBeJxdQvzVKeOZJCecfg+X7LkPEUbbVBkESdv4qOxaw==,iv:eAjnsndCmpdLNVK3oYRG8e1uc/O1qUjXhnCBwhS0c3k=,tag:EsSrN0XWzC7ZviABdeLNVQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaTNiQmVVckIvYzJBcm5k\nSFFmYTBTUHNpUFVzRm5hZytTcTNCZ3lqT2xnCkdWWnlVeE12V3N0NjF6SVpESE1R\nNElqaW5KSDlKVXMyVzRHS2lBNUZUZXMKLS0tIDVwR1pTY0g3LzVlcGR1a3hoQjE2\nSHJRM2ltblNHYVBsWk1KQkJIc1RLbFEKcNh7qYYq0/6DHEJ70pXpJLi7u8E99DVy\n5kmx3M63U3MuDV7Bfz2bFkguwY0xnGq0ekY3jSsFnBWzMVIoPdDQEA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOYVM5NUZUalR2c3Q5NzZP\nbWl5Z0tuNkduN2lKaGZ0bkhMVWg5NEM2MENrCmZQNU9oaVU0S1hZWHViWk8zOGhL\nd0xmWHVxaHR6MEQvWlZYRHRBSCtyalkKLS0tIFZkWmYxejE0R2QyS09wRFZvVndH\nQ25ETlc1ZjMremlsUlFQSzMxamlkL1kKrZ4zPBukie9lNbJg35dOt4Ic9M/Z3FZR\nWcITyYcycaci0ywXlCVZNwdz/V17dsPbUZTbx25hSncE9URFD9BCwQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
+sops_lastmodified=2026-07-02T04:21:01Z
+sops_mac=ENC[AES256_GCM,data:4ElcD/ADYOs8x3An6mSIPbJ2A4KM8ztCG+ea39dyM38HJnaCD2dyad2lwjkHWrEz+tn0q5+eDrWrJwmta8jrGHNY5Bf8FLVAvOcJkjbTYZ9s6v/UL7BeqbImkGy1/AfS/hUeEP+3cq4Lona8fO5FWQE97KAqxUE4Dtx/Y2Yz27E=,iv:7q6FlOZXF7HaKOrWP++UuqDNitoQtJCy94TrVHXaV1o=,tag:VDwImku499vhdRKhdzSJQw==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.1