diff --git a/.sops.yaml b/.sops.yaml
index 8b8dad85..9fb4ba4a 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -7,6 +7,7 @@ keys:
   - &aphrodite age1pq184qgj0fexyff2tlmfg4q2wgc9tx8wh6mjwf5dzphn3dzfdrsfwz6ng64902x9s5xwp7tmpyfnqmvaxuyppndzsxj00zftc6ne0vxy3jg3h0m8fsunw423fgegx9jtzw9sl5ypg4gw9ctn4nt9k4y0xa4v7jk5aaqqasf6qsghskt0dgp2uj64qn05sen9jnnnc6hwhpmcmy3y9av789cey66vmrjcf54nmr65v83uyspj2ev3fj9lgs9xql2wz0hyx2xmtzwtc48044srw8szxej293amqau5g5v2xf594wqxalraf4vhfdsvxjgnnr44ls6cl2tycm9tjy7nz6mz2n5z636jhzccyrpv2rstmy2vu7qq6m5pptwd3kmzcttzdvqc9gp4evrq0dr0gpmq99jwn7zsrppkmrw3yp3y7lxk7e8k8t9ac2cxljr30fxgzfhsyjcxamgmqr54hfm55af5dr876fy7k652hke56z2x8djwexsyjvkhxeg7en5jm7qw8yrx7hj64dgcd9ny8gcy9jav679tqncl5vct396n09qcnxp49ufasgzpyn6pr6fpmtzcz385608nxd0df7939asrx7r2kpe0n60wk2535gq0rn6gqmj896t3yx4g249lxsap5me077rfq22k9zlquauzgc60lq9t7vpe8l7rd5n7apzmdz8wypk8syznp9pn2jeq5h3d7d2m2jmfk3hzp9mszdk2u4aumpf6gqzm3zc8fpne9er2n8nawusnlpxak8qclgcjf2q2d2s2smyz2reqg5m4v9mq7vlyyvwlgt5axa9djks8j0edf9twwdzhfe3nlujrukzgu2x08qqyc820vqmzq7tm44mqwde2ecfzz92fpna3fdh0zc9slm3vjakmfncfeyjs5rev82jwz8jys8jv8qz672r7a49y7zyfdc85mk8jfw026vd99xyfzhrcuc0xgrms6g8z2flk622n499jppsn8dp54t4457wrfj6g4trkvua2nady7936fe4422cza6xnpu94wk6gu002dn26gap5hg8g70nnvrfs9r82djk6sz55ldmh8z2yllw8g28zfqamtgqltrzp4edrxfr0s0xnupu5yyyzjfcvvrpqkn5pjgxk6eus0y2lkhzvfx0w3lfswp2fjrccftvmp5urlnftrj789v5l9tlxw4gqczy8ws00w7fjxtwe5qelkr408cyflxnrnwr0vmvw6ruu33fkhfcjcuxv8dpkc0k7wtjy7vs9eyhxul3esk3cfrfj2awmhnpyltgzh35x7pwk6s0ya2g7yr65v0ngfc0rzt6734y8uyssy3yxh4pt5dv33q93q6adx6s2y28rhwpdtueswsdzx7stcmxk0uu5vnppfevzqxxz6x8kft9fe9el0ct5yrasrpk2q2ltzsvjqq3evr83t20vyztpgklp0p3rh2vrjzjqyn8dp9dnqtaxy2crksqarxjxteyc27aju2sw3s452myu5wh8zhm9xkrrg02cmr0zqqg7es3zru2wvjaguk9u6g6rq5slhfy9gtz0np3sr9pk4rj5gfjslevxghpfjkxngt4za27td343f7v32fqfrzmmpgacgc5nwth477f038jq77sszgm5gvmndxpcdzf3jez9zldws3yx6zjlnspyapej8d09wpwrrpa3txzlsq460zycxmnkrxmwuyy4jqnlysyjvvxkz28w6jcpqlvcf3u36ngxsv2d6gqqqa5zkzzz3u786cf3s7fzvfttfjnp2jgnapvhlgvwqqxxq9eht8fvqh4gsjqjjn29w4en5xrs4h60w200jzjxjd9zzfnpw40a4mtel208k6vuv5v9u0jzm6wpcvsq89nu39j7r63lu7pxm0g6mw08tx0un5sjv77nhcy5esr7tvfdkrnln86xvvwpayy
   - &isis age1pq1jykxgs7z8l5gzpg6j40qp9vzpnkz0a3kern2stm67xjtj6z0lfs32836dafmpvj62afwpc5v2fyhajjjjfzjrvsspffflgdz8pk22tgq2fud8nrtlx7e0s32t0f3s284q6h543vuyvxwf9rfjhc9cgnk9la0zg6psvv9z2m682sth53zr0f2fxkmv3pcpz6vx4n9gmgnq22ax53zyyulphz8htan33d4ekgxz3fau90j02njss66uxks4yn8kl59wu25usf9rjfnccgx9xt2cnwnhs7nh6zswccmhs0gpvkghx0scpyy8tqfcgcnfjl69zlx2qj7jcu42799erd95nrpfszq8yq0pywu9c6knem5v4w2sd8t5ahaw98x8smj49a2nfvetwpaxr6299fkgqgcccs95lter6muqha5xym28ryu4tpsf9hrw6rkze87c7n9t4drh733c8gqhtcp0q28cj2snz3dty4psmtn4kfv9yc773ktjk6xdp2myfvxfyz8tp90valfv6jx9prrv8yccu8vv7jdsc40hugastvvqr5mywl6rgwj9phvh76cq079u7dch7la2u6qqprunk930vuqzjx6fllwhx6as5xvz3p2lx555kpegeej5ggtvagskyt65tge0a5zhmadttrt2zg83um6hz3hgl0pp63jqvva7u0kqkz4censz2gppqcmctpquj3xqx2w7rmyxeq5dwnp5nyugueywm9a9q3xfuq4xgqc88w4y58zq45ejvycmlqsxmc78sa6xcy8mkmy82afdrqc5x7fcx8mdj0gjw4w5m9g6c3stulfjlju8z926jwyljdgcha258xu5dprcvt66vufe6tu45t309re2rzw9gluvyzw97un9m62crd34w33u29uu539wtr4aghx8nrphvd23pt87mqusuj4gf9yh252q7hhgcgrhq2hs6esp9mpq9pf8wvtusz77c3wjpducg55gkjyqvu6y6mn9d3fzspn20frrylkqsw85xchrej06hvtrxut9f4tpyaz6se983vmpjnvx74hy6r7kjedyf06fja8jrvnsqqde64zvg98za8qftpravy6mynrnyuu49knvev3zzws0xusaepz3wd2vx44cc0dau3u88cjtgd6ffq333upszxftaas2tgjfl4ezgpztw4wmsgh8xeczcp5yft3kt7tq55hnvzkrs92mj3kg9jsdk5d8j3jpxz29zsaxjxqry8jreyr2s9nqf44ls9k7npv89lqervqtx45fzu3rnpkjer4fact4x5mvqazwuwe3kasqx6rscqucqe53r28whqtxyrpxz6mr466e03wk5lvgsxycfv8d0gsm7r9ys8a4jgayqr6y52wgdfxm9aqyfvext02vvpauxqv5pqsfggmx33nzpn5g4jy8rzca79tlfynqx94084kk7awyqxrtx5q7t72gy6qr8wnazeg075y7cfe0f5ur3pz8wn0nzqkpue9f6aketqu4vxqtsc5ck8xkcr745tvyjfjw25zdjvyjwgljw7fy3jhc34rp293zjmjkuxr855su3jqya7e5hw2sravw4d9wf9gg9y38zpxwsxvpj8gjmxexxju3729e4srjg72vfde3s728yet5r6gayj6zhjndzgs66pvqjauar3utg88d2m9nztusx8wa4yd7hw8vds80fln902d2jetd3c9rp685curr3jdc45y3w2aggyuc0m5q7ekxh25ys6y09xjxpcql7m9ghz9980tydfsqw4ft5c246ggrejgqety0x489xly7sspandcku8u32negtfnvdd8c2th49kzdzl7752k4e7xq0jjn5fnks4xs9806sj5pydcj58tcfne87rcu4ghhw0x0qjfe4lg6k0xwlhn8eh669jhxgdd2mh3xxdtwqnc5d03
   - &freyja age1pq1sa96yjm8g797e37gvcvyx5ad9y2hn8l38vath30ttd9334qlxl952nkef84kfnuygylaqga4y9te8rxvc6tahwms2q5xl32eymjpj036rwuax9756zn32gr9y9umrljhgqwcz3ts82frl5fz6pjffff95d7wzcnza9j2ld933g44hq96hzn9e2c0jmxd26qftsmqd29yw9zeewexl3kkj2deehmj6pmvxk2askd9r2sxjgttd92tjllcwdtkxc2d2azl75anvfejv06qxgrjef07ukxfrrppqn5g2k2frmxek37wxjy94wctdxq6zgy39mq225nsanrmzjv09e2fh4dnvh2mvj2s3ymph5w9my3eazt2ck9fxdxe5us0fqv3vv9rzzxvn9xayxr9mvtf2x9eg8yg86529zqqhxt04qzhuy55e6tjenrreduac7arqwvl8xu2lt2ku756jc7ehttdapmdmlrv29wgd9dzng8x280s5xqxnqjm6eg8t55jrc67sz4qexw3rpvuphgj3xjmdhwpv722x4ftg5d8fhp45dn55xkkcpdqmdazuumqr6s86h84whxjsnvyqfmm67pmw4fhf0yzsw2vzwyy7fuevwdrw46srvp2yk44y6j3rqd0l7uxmcc4n2s24gpz3flwfxdsp7s2k6kqnzdgwln9cpmnljv3epvypzn8r9cu57nn3fn2d3gkup96q995df5zyghxgy6ayarvz3t8dnymgqgpge08zgph9npepjytqhqf9gtcy0l7549jxjl0h5z8k2ek6kcfdw6cdwc02s7tuzedul2rt6hnxmdhwvys520s80qzdhp3s55kzc96htpar264skvkk6tukpues30f0va7xch6cqgnv5d4h4ttgcgwddchpxa9w63s329sadzgjlu20nefs56y57twmyd260re23npzm4ajk5fjqwv4aq8gpnv9z07pg3c4ztwmw207ju9t3whytchnw3kudkwmszqfp9yx453rqd2yazl0s6pzym8r9wpkcx8de472lzt6e2740z9efcflx0vpdvrsuguju6v7xv9np3u7lc4ngkn33s7upuzy77ggl9sqsrryq6kce4y0qphmqtmsedzy5t68hcdjcqz2tpwd2rcpprmyg2zdwykq0pauhywdycwf642n5f3qt2l26s40sltssdrdtekcah8gs5728rhs7cjtzyc8nz9y5sgq889pseevvmwn7q3fr7rrph505uvyxdghfp5uyan6vrfzdqjg0zydgpw2h9j8zpqwnms727evax4x8y0nx233hzm84vgkr3z973hyu9lkk40rly7uuuqpw5xraar58g8zp2jpxrzxvwt0uxfzmrpgr3eaytdvsesvdsu7x244cqqwam72v2ytx6wntu60msm3tq53sfery035un9xpeq9swjg9tzj5cq7jmpnumzggcf94mf0j9eqlq643mzhvtpdu38w354tjymjk234smwz79lxaaqgs0gvexsrr3ec0rrrvjdykgulmlu5lr0tgulke34y3zh6mce4nvqql0qvdejkzen9yvn6y3hy9ry5s7c9sz2d97rdcxfz4npcwhv4kqf8ff3lj55vcmrm7r583ychaeq5panljzmtg79jfshn2djcvh7ptxp9v963z2jugf5rmh2p5p2zel8cysfdzuljk6uk96jj88408vz54hu4dp3m4q4gdfjrv9cd9rxpqxuhmqxv7q497f3whhzsaspzmxf4y5280xrceef37u4033z7v27lsfk3njjxwkhte0vwpr9vef64w9gyztqejzxpkzvgm3avv30094zsz233y05v6mth7098ckc28jyrz5tvge32t93rtetwfasnr96aszu27cfjr0clkc9lx6wyakvkaads7xlr0etvmvn48ycaxperuc6pmdq
+  - &amaterasu age1pq1l89rp359cz5vxqkcjv0sucsj5vszf5yj5s8f0wfmukgl4xnf65gft86przpawnhrhw7pq7e56u5ffyeepqkwym6tfvggv9d3ywmns2gvtfpmpqqxua85ezg5p7axtz3s0zw2xvt4993vuznenss98pm9j9ul53z6wen5wer6sqp90xp6j97xcatvzcwcre6qwed6nhf5s34pyvrkv5u489rn4usczen2tvx7c6k6ww6jkjjhv4f93r96nf4wvz7n2p2vryskkzgjz0mp8v3z54ntyw08n62jkvx8vtrg5466dzrehfcphxphp65sj4fnxya6nfe0zq34fzq3wnxppuujqjczg0uw9yzw9kypq6x93yexk8k9z97luqadj4vq8te5fmyjtwhnxtc6g2ztzjdmm4f2w0a4tff6zxjg60qlt4s65ttnrkmr9558g0jsafe2xdm8w0jhtgwtpk9acfy656x7hp9wy8y4vvwzwqxpc39d4888tv3f0n3juv9kgxz7t9fcwprds4qf9h6uwqxkjdgkv47nwg63s3nftf3pyxljglrc2whmkzz4u3eh6xpxas2gpal39rg8y2cf6urpw8j5wgeh5vvlywavx4uyfc7fltgfpd9pjjsaz7eqxevltwa0vat325c24dzg8xcewppjpgnyh4pu9lwnqzn39yjmzgu7aq3chp4ecfru0j6cqltudz58knqsx4fh4vxmwpg94q0ujf5yvc66ylnyz2q34l905lhx6uf27g5wqgsr495vnsftr9d86yt50e3yd6ux5mjz9mgl4npf2tyde3zktggshaujn3dfnd7pzwkuq9604k6mh4wht42qnt5y7fkynden2ud9n4t99pjysncs4q8yny7wnazgwe5hwcjmzrhms0zftyr60dmpfrcpzdhqkdx4k445nxcwjrprc9u68vect2hnnxs6gw4z0kfqpk28z0xtc8fra34lt8ya5ztnjvusjch8r0khy2ufjpt2r8vnlqng3tnwx93xlgf99jad434pqay4gznked4m8f9mkh99xlegqxeyn2y7q0flgwhkq73pqjt6qzsq3qq8wc78f0zxlfvahdnjmdmu37rg0vrexxettvr9lr9h48xj3wkmcdj9m2c3aqvspqkphsqqh5e5r929gkrfaenqwqesq64urkq9fwff9r8lj9nxtfnzq4d85ml4g3lal32dd7nwgleknruucv26glvvef0ddja5nrw9yj5ry7wlkhymts250yjhl492gt73xrlnrs3p2wec93d237yj9rw5kelwcjdzlj7uqs9rpdyyrswfkg2jpse02qpfscngwcty08xucqfgyz9jukshx9fqpzsyfv98k0k0qn2pv55dj9nl5yur02c3kv2fewarp2mct32wxxqn7g7t25yedzu4f9c8ekpfk7rfcw79jgpykl786j6x3sfwnpu4fqdfzmm43qptspxxd47tcan2x7c9pzau32tdja2yns5ldurzyfc2xmfunzz6yzfzlff7zyvrfkpm5s2rs8zhrf0jytxfqpetxys9v3hhz74ujdqk7a2qmc3jrjd6nnwr0xgwcgcwgur0w8tuq9294hvsnjejsa5jyg9gxu9cqe8g0v7a8jr269mnpx4kgcg9zhyr03mydf6s6plgdx92u7j6rw65jgc5ttw5q64kz5wg4dsurdc3n6cm580ywf45kzr09wfg73xzs5d8vtdhzspl66y26fqhy2yj08wlrwwfxxucw32p0er60v8hwnsshxsacaljyak06uj5t28ucjzjgwc0gws5v7d78xcf0druchalsdl9j7s0j96msywkj2aufkycm2t8wf33kd0ddl58rrukzp5ure86zy95f09zkngvjgxa75f86vawgq53y3wjz44ftqd803n3qkyx6ulssmugqyf7v7ce
 
 creation_rules:
   - path_regex: secrets/isabel\.yaml
@@ -14,6 +15,14 @@ creation_rules:
       - age:
           - *isabel
 
+  # the nix store signing key only needs to exist where builds are signed,
+  # so it is not encrypted to the servers
+  - path_regex: secrets/services/nix\.yaml$
+    key_groups:
+      - age:
+          - *isabel
+          - *amaterasu
+
   - path_regex: secrets/services/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:
diff --git a/justfile b/justfile
index 1b2715b0..158ac4ef 100644
--- a/justfile
+++ b/justfile
@@ -29,7 +29,7 @@ builder goal *args:
 deployer host goal *args:
     #!/usr/bin/env bash
     set -euo pipefail
-    just builder {{ goal }} --target-host {{ host }} --use-substitutes {{ args }}
+    just builder {{ goal }} --target-host ssh-ng://{{ host }} --use-substitutes {{ args }}
     lethe record {{ host }}
 
 # deploy by switching the new system configuration
@@ -52,12 +52,12 @@ deployer-all goal:
     set -euo pipefail
 
     just deployer minerva {{ goal }}
-    just deployer frejya {{ goal }}
+    just deployer freyja {{ goal }}
     just deployer skadi {{ goal }}
     just deployer isis {{ goal }}
 
     lethe diff minerva
-    lethe diff frejya
+    lethe diff freyja
     lethe diff skadi
     lethe diff isis
 
diff --git a/modules/base/nix/substituters.nix b/modules/base/nix/substituters.nix
index 3cbd5d0a..237d679c 100644
--- a/modules/base/nix/substituters.nix
+++ b/modules/base/nix/substituters.nix
@@ -12,6 +12,11 @@
     trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       "isabelroses.cachix.org-1:mXdV/CMcPDaiTmkQ7/4+MzChpOe6Cb97njKmBQQmLPM="
+
+      # the signing key used by our own machines, this lets us copy closures
+      # between hosts without needing trusted-users on the target
+      # <https://github.com/NixOS/nix/issues/2127>
+      "amaterasu-1:N+SYn51iOvZps5JxxLwPSGUjVYHKf3MM6yMvDn3wkMI="
     ];
   };
 }
diff --git a/secrets/services/nix.yaml b/secrets/services/nix.yaml
new file mode 100644
index 00000000..486b47df
--- /dev/null
+++ b/secrets/services/nix.yaml
@@ -0,0 +1,87 @@
+signing-key: ENC[AES256_GCM,data:DHT+/ozE95YSX0FsXSYQFagP8SY8vbf4R4zb0P2B+by0bzlqjeV3hAxMc89Y0sIN8/bqGbELwqGIdyJXtQBRS8mLrRHrXMcn44i9iyGazlKiyjOTrAlwp2LjIUa3CPf3lPu90Q==,iv:LT+8d6Cg4m08XYkDuCe39uL9gpxuMfW1kWBHPnTnD2o=,tag:0QKuRAxzKUrgyJ3WKIwiTA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IHFTWldJSmlm
+            VnIvc2pwcEJnalhTdkdMRDBZNGNkNEdCRUZKZFBVd1dDKzI2ZG5Zcm05TXZnWXo3
+            SGtwMWxTam93Q25rWnkrbEd2U0F4Rm81K0FyREV2bEVvQnhXaXM0RU40Y3Z0am1q
+            cHcyc3dubUQ5VkY3Y1ZvM0UvcWk3RERGdEw4SkFnY3lCL2c5NUJua0tuNzNSTlAx
+            VWFqOXltRGUwdnkzYWV0aWpzYmpZTXgrQXphTk9uVlJWcW5PSmNJSSt5bUh6K2ds
+            bnhicGoyd2xlZnZ1SDFjZ3Z2bm9jRmJiVGIrUkR0Vzk1NDRmampWZTIrMzF2V0pr
+            b0c3bnV1MjhTRklSRTE5N3FXVjRLcW9yOHJLc1VxZ1dpUmFzNTIrWVFwQjFOdmh5
+            WVdVYm9IQXNmSm80ZjFyN0ZHVi9lYlBxc2gxSFZvWGZOV1VmWjljSmNkbkgxcEs3
+            TVNFRmpSakJlRzRHcDVaalFUTDc0NkFzbXY5YUcyOS9IRFJ0UWhWeVBYWXFBMzV0
+            ODYreWQ3VU4zWmcxQm5OVnRNL05NVGI2dUhOdWZWcVFadUJIeG1tL2hIRFZUdVFD
+            ZkFUMnRnVU1FRVBxdXliVUhlSVFnTlhqUVR3UEF2cjZ2K2kvWmxOMWlFK2g3U3JR
+            Z1orU0czSFVKSFJ5V2NuMEtHeXcxc0JGRjdIUUdLMVlpcm9VUklxVUlNeTdqa3Nj
+            eVlTSmlhYXVMV3JENUFjYm11ZUNpemliSktMSVFrVnhPcXYvaFNTRmdtUXl5VXZ1
+            UjB0QWJBQ0doRkFLOEtuZzlacHcxQktwdVhsMUZ2dDd1SXhmeU1IaFVTWlhyb3Vz
+            SHp3bnRsL1MyMFloaExDS0FtbEtoemt1ZTBaUGVmUkJVWmorbkt0Y2wyYkdkMUhB
+            MjhmVmlnak01MlFSOVJ1S2ZXVk1jNG9wRlcrNkhwcExQYTlKZ3htYW94TVFkdjVu
+            RkR0T1NWdUNsM1k3QnJyK0RMcGoyenlTS2o0QS8vY3NJSEYzK0V0QXNRL1g2TjhG
+            VHQvZEx5cFZkNkViU3Brb2lNajUzQzdPOGNKVjhGMFJiclRXb2R6dEZGQ1M4bnMz
+            b0FlU1U0Qk96Q3FLeER1SlQ5L1lRL1lvcXpRclRyUnpKK1VYbzZqNWordjVsU2FR
+            V05SaGhDc2ZQakVZNUhlOEtJNkVOM3hMVStSdUFLZEJRNTdCRXMxUytUaFVMYlZt
+            dSswYUpXUzNxWlkvelBPSlA3R3pFQkwva0tHSGJPOGxNM05DdDN1RmZLV3lFbkt1
+            b3JHZm1XcVhjVlF0aUpLUlJPSVlpcG16bC9XNkUrUDdicUQrMnVEU21kdWhEODU2
+            RnNiNURwaGVUWmM0d25td3gzd1JIa2QxcVlOYzVMa084NTdJbHY3S3RjcXF5T1V5
+            L3krRS9Jc3Bad2V6RW9DQ0MrbnNVWEZNNUlsWkxNczcxejNJTFJaRFByQVBjVG0r
+            YnB1MHhmYXVBRG9hK1Y1RkhOdmxhZkEyWnJGQXdBWVBFRkZyK3gybzkwQ213NCtV
+            V2Ztck9YZEQ3M0ptV2toNzBNb0dVRkVoRUVhWU04THJuTjAvU3JFQzRjcXRsWncx
+            WXc4QmhVcGVpVW9TM0c0RmFndlNNV25TUGpVZmQ2QTV3UXRrTHh4aFlQMVRDbDRE
+            T2RPTnE0R1hlTWVyS0p0eURtdXh2QjJKUjRNVklycnJCbGVRbnYxYXBZNFRxdGN3
+            S1dRUFUyRk1FaUNGeGlOeFZiUFhwNm5mQXF3QWpwbXlsc05Fdmd0TTVRbDBtMVBr
+            K1R1cmtwbEY5KzEzUG5VUkd1Vm9YK1pNMm54ZXQ2cFlndVJ1UDlQSkhsME5WcEtI
+            Z1pwbTlUeWk2aVB2S2pLZEFidm40K01Lc1dvZlk0UkdQZGJGUXZXckR3d3JnSkFW
+            Nmc4YjJKUjUybFMwMDEwdlMvSTh5MzdXb3ZFT3UraHFmOHBMMnpTUGxBazNQZwpL
+            a3dBWFdhb0ZiU3E0TVFCRGNEdGo2M3RrU2NJZ3BjanAvQlk2MVFib3JzCi0tLSAx
+            RjRRbnNmaEN4L2VqUmpaZkUraytkK0dpeTdDMi83TUtZejQ2ZE1rTkNFCuH4p+LF
+            Jy5baZKPT+FOqGPwit2h4gdaqEixvzN+5HElWvhL/IiC2kQw0Ikf2tE0YYtNvS2W
+            z3PKJVMbLxVT3aw=
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1pq16qr2455xvnq53vmayvyyhwd29mpkc27mk9p2w2h3j7wrgxp52gv8zq2tzefjv8c0qjqtjgd3ydmyrqdnw098tzm7jcm7wnzqk039kkuqqj4feggf5jqgasg04he5lzzqgkxtg53k4g5av3ngq5y9wnpfqarykeg0nx6k07e7c5fvllevp0g2fjaqgyhpatzk29amhg9phw65nwhyfycw8u98c0myjj5c09d02c3ld2f3e3d24z9kfql3g4vzsxcy9zvhu625j8z5ke6ugz63zem9pgvhzhr9s0eyt9fesjkjtfzuwhq2j5jzzgm9928ctp6mwhxsy3sqzpehstesfee5jr57gm4j73jg7xn3eurmhvng355tw067897z3um8detxzseecl5jrz5layk5gjc6xcjx69t9d2fk0ymve9yq9mq46ckx3ppnqskhq5lt3dv5zj3n50dek5xqzsdjj7c8lpmckaaptesfg7xfnrgdx3dx9pqlnsmnj0wge66m5utz256k2zwek6rmnyt45phk9lj20nlejzhaqfdxnfyr0ajrpfrfw5w6tg36xeue6h3sca8qhjvrve0mvstmq5y4guekvyjje4p5pznfc69jk8zj82r5n8kkdqvrcm759sufk3tqk5j2x97v4wc3s68qs9qhqp9luke4mlw9hdrwjcawes9clc6834mfym6uz5j8zzf7g9eldtr6u8a9cehuwadv27hrjv3w8w5ys0f6uvqfk6jwk4637dwzm8rn0e2m6x43zmkaxek0wc7ux5ztfzdupdxgesemx8hsn3sxnv49kwarrqgpsaq42zrcsqggvrzmln9c89hmhrucer5m6sekwcsy2jyjuch6tp3qyd8k78xhayygycess73x4wwg38xv8ft5mk9cg7nufl8vpgz03r656ujguf3h827znpg934pjpfczj8yvhtrqp4dfkdurtytwpq72rwdk4d45uxeufzg30c632ctre9rjvp39t5tj6v3kxmts3xd6y4kjsccsjkkg475g04uv5jjqr3ly9ryexd637wnuce6vqu30tj3znkj05eqfzu0chx4gpdmyey7g79j0mr2ngca2pp05rz400sf2g4z2tt6keq76hsc5vpqn6gfxwjnvgwggnej4sz5u0ru8vn8cz44jzp32g0e82ulxjwvwkj9069um2x6cwsdmsjm9x3ucsv0mcv2zhm4qjty2g7t63xp44ssr9zql4e3htpext89dnzqhq67pd9nr6yqtfel3jpkakjh3cvxhskjnr3a4yqmnhgrzt9wgsq2kz5fexq5uwj2vdktkzaqw4f40k3f4c26z6xup8sqfvkmtxythc7z9ks6jwej4q6mw33pk93wtefumzsgtynfkkfay4w70ywcs9uw9z5a8ce585h3zhq9wmxj93xvzj6gt4l3e5r4qdjpewy6upyet6fu826kzs9mfzjjugdehpg5j7cn45kq8fln8n2swq4qmfhz7sxgfxag6g6qs02caxzr0nfm93t7yet8fk6t03rmsp2r0l4k9kk6yyt6hwldx3dczsscx8yxdm4vxnf2rtqd9p3dndsydgdasxzp57qdecvylvcr60y8k6xpq5lnqhqqcqhj3ydwmmw4n73th5n2ge04c8kddq07ezv0gnqcl3jahplw9zgrynvtq3xmc5hyn3s7yktjhfup4swfewyahxac50ls8gy46dw4jj0rzgd3awj7t9neym7un0txprzmxx6knpupcfsje8c2xr0lcz5g6k5jrgg47stfr73nezfd2z9ajx92v2yxytktsy5lssn64z2we7c9sp8mchj6l8cdywg8w9mv7ne2a3ya0yru2sldmxkdnt0s0pt0xt398xskm76plneagwljxs4ax70u0uymqgd4z68e5gkdhmvplza6r2qram24r
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IDkyVG9PTEF6
+            UFBwNktUQUVaZENONDFSN1p0dXlLRTh2YVFyOGNhcTNPc1lYQlhRNmZCTTNGQUF4
+            S2xRWEFxelFKNWVpalAwUC9QMmpzR0ZQaXVCSmhzc3VXa0lqa2dWWFhoNjBkaVBU
+            b1pRenA2OHQrellWRVBJbTd2TUNzdy91NzBzUEdZRUo3QVdSZjJBakV4WWx0LzJt
+            T0p4UnNhYWFLUW5BZ1g5czh0NlFLbTg3VWRGdmdrSTFxKzMxSXlSN2cyRFdWN2d0
+            akxEOU56aVRZSWNVazA4WGs2d0UwODdXUmwvV04ySUx3S0RHcm4ycEZJRTdyc1VZ
+            VC8velh0aWgrNEhrbHNpcVN5ckZRUk1sVFAzZXZRVHM2bllidlJhSnVaVnRJWDI3
+            YS9zN0s5YVl0ZTE5TTZsaTRVMnFBdnV5TFdmazRMMnR0UWQ3MUdobjdJSDIzY3c2
+            ZldnSXJKQmc4L0ovTXFRU3dObDJyRGxEdndFZUlzeFlIbXN6eG01Wml0ZzdZeVNp
+            d1k1dzU5MnNuRWpEZHZCU3BpSzNQcjRUUm5kdFU4Qkk3RUgwMDlEREdhZzVPNzhq
+            YWQxVWpFb3k2M2F5SHJRTTZwMGtQcnArVC9Cd3ptUm1qRGQzSlp6RXdreWM3cUlo
+            M09TcTJiZUtldUZZRmpTUmtVTmxnQkgzUk1pSE0zWUV2eHBXVjA5cms4QTdYcTlV
+            dnBQMEdqU0d4MkZqc2UydWMvN0dYVEFXamtQeTBNamJ1dWRHeWpKZENlUDFyRkU4
+            S0VaNm8xaG1VRTVXM2I0RUJlK1BFY21PMENHdERVREMxRlIrQVh5RkZrRzlUTnpB
+            MitiYm53eDhzeU9JYks0QTFzQ0kvQjhXdzBMWDFDWXl1RTJBblU4Yzh6dkc5RVRk
+            Y2NUQ1pmUDBNMHJMTGhMczdTd0QyS0lGNUtuT0o0eldXeG9CeFNPY0hSWTAyRUYx
+            cXZubERwNnJ2K0VxV25waVU3S0k2K09keVdPYU9Rd25EV0N4Tmp6RkJPamgrTERM
+            bzBkSThGMUJ4MitabTU4b2hxKzJCak1oL0tWZVRqOHNXRlVHRldTSlpuVERzbTR4
+            ZDdDYkF4Z0ErRnMvMzlURXlveXNqOXRVNlpyOS9IcXd4TjdZS1hwRmVxeDB0WGl2
+            eStVQm54a25iUXRqQVd6cm44TVdJM0F6cFlwQ21ZQ0s0VWdJaXBodGJaaW43MGdF
+            dUZHT0tKL2pwelFxckNZem5Jemdia2gzMVlsR1ZsdTVsdnNpMXc1ajZ0aklxTUZU
+            WmFhanp2K0JGam5DdUdBVlA0NlZZWWVZcXBLMkZGUndHMzl3bzIrR1BCdVM5ajNy
+            YmE0N2xhZzFaQ0N5WkpQbHlmVGZrZzEzTkpmNEd2cWc3WDE5WGh3OUszcm4xRFpG
+            cHZvak0yeHkzV2h5NGE1SW5OZWtudHd6TGs0V2tMcVhSQldIaEx0ZCtmN2I5UE96
+            bWZYZlN1NmhlZUNKbU5ISnJJZ1grSGdvRW1YNFAwODZCcVZJVTBvT1lvYXRLTWFN
+            Nkx0T0tHTlRqTk1UVjRFVGh3cVZvT016NWxXait5L0RrOXVsSzlBUThHdzlRNGlp
+            alc4SC96REtWaXNHd1NLb3ZaR2FpbHdZMXpXbW1TR1ArTDRiaGJIekRJaHZJMmE4
+            OVdKYmo4cVNZQnhnRDMzeFFsUWtXcFlTYVU2S2dwTlplY01obmpDZ2VwdmhieVpo
+            dUhueHNhQUNpbWExMzVlbjhYd3FILzdIeTFmV1d5M3FkNXlXWTdWWThGVlVnYzEx
+            cXV6Rm1RM0pJQUdqYzdxbzVXeUN5OFBxSWFORm5ES1BPTmtUd1ZUNWxQYTl3dHVK
+            QUhXZzdrVWt3UGUrcVE1L2dVTlQ3YW9EclJob0pSYlpKbkN2R1J2YTVHbTJ0OFY5
+            dW4zWDNQWlZtaDBIOG42YnNtMmNVdVJZeDNCb2QvWEloMGdzZWFJb1VFcXdNZwo1
+            WktqL1pUbjZaeFdpU1NSc2tydERUS0JvenIwWWpKSlRnNmN3aDRJM1pFCi0tLSBW
+            SGNXSlNGa3gwRGRUSm9KTi9CY1Q1UHlTR21YZTNBbkRDQVE2ZWlMS2tJCnW62pQk
+            qOMx7qrDgOCSTEEKBiqQNwzwPfHGELTMh7l1AW4sU9QJg9UNZmNEd3Dtno0ac87+
+            dEvTTEejRNufv10=
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1pq1l89rp359cz5vxqkcjv0sucsj5vszf5yj5s8f0wfmukgl4xnf65gft86przpawnhrhw7pq7e56u5ffyeepqkwym6tfvggv9d3ywmns2gvtfpmpqqxua85ezg5p7axtz3s0zw2xvt4993vuznenss98pm9j9ul53z6wen5wer6sqp90xp6j97xcatvzcwcre6qwed6nhf5s34pyvrkv5u489rn4usczen2tvx7c6k6ww6jkjjhv4f93r96nf4wvz7n2p2vryskkzgjz0mp8v3z54ntyw08n62jkvx8vtrg5466dzrehfcphxphp65sj4fnxya6nfe0zq34fzq3wnxppuujqjczg0uw9yzw9kypq6x93yexk8k9z97luqadj4vq8te5fmyjtwhnxtc6g2ztzjdmm4f2w0a4tff6zxjg60qlt4s65ttnrkmr9558g0jsafe2xdm8w0jhtgwtpk9acfy656x7hp9wy8y4vvwzwqxpc39d4888tv3f0n3juv9kgxz7t9fcwprds4qf9h6uwqxkjdgkv47nwg63s3nftf3pyxljglrc2whmkzz4u3eh6xpxas2gpal39rg8y2cf6urpw8j5wgeh5vvlywavx4uyfc7fltgfpd9pjjsaz7eqxevltwa0vat325c24dzg8xcewppjpgnyh4pu9lwnqzn39yjmzgu7aq3chp4ecfru0j6cqltudz58knqsx4fh4vxmwpg94q0ujf5yvc66ylnyz2q34l905lhx6uf27g5wqgsr495vnsftr9d86yt50e3yd6ux5mjz9mgl4npf2tyde3zktggshaujn3dfnd7pzwkuq9604k6mh4wht42qnt5y7fkynden2ud9n4t99pjysncs4q8yny7wnazgwe5hwcjmzrhms0zftyr60dmpfrcpzdhqkdx4k445nxcwjrprc9u68vect2hnnxs6gw4z0kfqpk28z0xtc8fra34lt8ya5ztnjvusjch8r0khy2ufjpt2r8vnlqng3tnwx93xlgf99jad434pqay4gznked4m8f9mkh99xlegqxeyn2y7q0flgwhkq73pqjt6qzsq3qq8wc78f0zxlfvahdnjmdmu37rg0vrexxettvr9lr9h48xj3wkmcdj9m2c3aqvspqkphsqqh5e5r929gkrfaenqwqesq64urkq9fwff9r8lj9nxtfnzq4d85ml4g3lal32dd7nwgleknruucv26glvvef0ddja5nrw9yj5ry7wlkhymts250yjhl492gt73xrlnrs3p2wec93d237yj9rw5kelwcjdzlj7uqs9rpdyyrswfkg2jpse02qpfscngwcty08xucqfgyz9jukshx9fqpzsyfv98k0k0qn2pv55dj9nl5yur02c3kv2fewarp2mct32wxxqn7g7t25yedzu4f9c8ekpfk7rfcw79jgpykl786j6x3sfwnpu4fqdfzmm43qptspxxd47tcan2x7c9pzau32tdja2yns5ldurzyfc2xmfunzz6yzfzlff7zyvrfkpm5s2rs8zhrf0jytxfqpetxys9v3hhz74ujdqk7a2qmc3jrjd6nnwr0xgwcgcwgur0w8tuq9294hvsnjejsa5jyg9gxu9cqe8g0v7a8jr269mnpx4kgcg9zhyr03mydf6s6plgdx92u7j6rw65jgc5ttw5q64kz5wg4dsurdc3n6cm580ywf45kzr09wfg73xzs5d8vtdhzspl66y26fqhy2yj08wlrwwfxxucw32p0er60v8hwnsshxsacaljyak06uj5t28ucjzjgwc0gws5v7d78xcf0druchalsdl9j7s0j96msywkj2aufkycm2t8wf33kd0ddl58rrukzp5ure86zy95f09zkngvjgxa75f86vawgq53y3wjz44ftqd803n3qkyx6ulssmugqyf7v7ce
+    lastmodified: "2026-07-16T11:19:34Z"
+    mac: ENC[AES256_GCM,data:9w2eLCc2HoiHqYSi1Tiq86oCs9ZZRZGlXCdy2uUsh7NsHZSnl4sATLg7MKkJ94RaL4JCta8aMIbFcPyoq3bhwDTmZRa0gwC26/nMlRiNYc0XXvB2R9fPjSImnvrvomtZeTClMrUTEUNw2gSnthV6k2kHT2TQjHuaPAp5vRbbpgg=,iv:ImbhP4PbHL5cQHf30b8SxrkS6UJiZIZb/7RCdJxNcxU=,tag:9kyXPIkHXdcZlzPHOuMYzQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/systems/amaterasu/default.nix b/systems/amaterasu/default.nix
index 460fb45b..7240939b 100644
--- a/systems/amaterasu/default.nix
+++ b/systems/amaterasu/default.nix
@@ -1,6 +1,7 @@
 {
   imports = [
     ./hardware.nix
+    ./signing.nix
     ./users.nix
   ];
 
diff --git a/systems/amaterasu/signing.nix b/systems/amaterasu/signing.nix
new file mode 100644
index 00000000..22923c50
--- /dev/null
+++ b/systems/amaterasu/signing.nix
@@ -0,0 +1,12 @@
+{ self, config, ... }:
+{
+  # sign locally built store paths so they can be copied to other hosts
+  # without needing trusted-users on the target
+  # <https://github.com/NixOS/nix/issues/2127>
+  sops.secrets.nix-signing-key = self.lib.mkSecret {
+    file = "nix";
+    key = "signing-key";
+  };
+
+  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
+}