diff --git a/README.md b/README.md
index 6e06803..9577c93 100644
--- a/README.md
+++ b/README.md
@@ -157,6 +157,13 @@ cloudflare_tfstate_access_key: foo
 cloudflare_tfstate_secret_key: foo
 # https://dash.cloudflare.com -> Click on account name -> Copy account ID
 cloudflare_account_id: foo
+
+# https://console.hetzner.com -> Create new project -> Security -> API tokens -> Generate API token -> Terraform (Read & Write)
+hetzner_token: foo
+
+# Proxmox login credentials
+proxmox_username: foo
+proxmox_password: foo
 ```
 
 ## TODOs
diff --git a/infra/staging/root.hcl b/infra/staging/root.hcl
index 4167557..ee9d8e6 100644
--- a/infra/staging/root.hcl
+++ b/infra/staging/root.hcl
@@ -41,7 +41,9 @@ generate "provider" {
     {
       hetzner = {
         provider = {
-          hcloud = {}
+          hcloud = {
+            token = local.secrets.hetzner_token
+          }
         }
       }
       proxmox = {
diff --git a/infra/staging/secrets.yaml b/infra/staging/secrets.yaml
index dc9b165..9718792 100644
--- a/infra/staging/secrets.yaml
+++ b/infra/staging/secrets.yaml
@@ -2,6 +2,7 @@ cloudflare_tfstate_api_token: ENC[AES256_GCM,data:XYtgdd+Xi0evZTyWOzoL6zj74FJJii
 cloudflare_tfstate_access_key: ENC[AES256_GCM,data:35GI8IiVUCTseqh9gLqjMnFYutXS5wxVcgKke16CZgA=,iv:6ixZ5fbaW9PtgFtSGsQwdNwNFpkqnX4FNIrJhWUVnos=,tag:qS5WuN05G4vvxnFuhjshOA==,type:str]
 cloudflare_tfstate_secret_key: ENC[AES256_GCM,data:+EL39un0LoIG+9Oxf80iRdBun2kAWzpCuif7aCX4WQZLQ16eWK8QYv4Cylyu4QBnUdksLgRGkh7MJ93TNsWBUQ==,iv:3AMj8mylIkR/LM+5B0HDygsv5vSlfRGbXhE9jjk6bZI=,tag:TJWwWiTwRXw/sYfTMmBvRA==,type:str]
 cloudflare_account_id: ENC[AES256_GCM,data:1Ucwh92YRCU97O/TBQZh02HIDp/s902Dg6GL7s3xmR0=,iv:/O7ez1bwCSktYgG/vj5RvXB+A3tmlGO5PYZ+BBM9Kv8=,tag:SH/T5Ez0TtmCwPOWpzj65A==,type:str]
+hetzner_token: ENC[AES256_GCM,data:a4Slfy3F2IwXIrThN2grrn3Tjecp9Ga3JfNqmUu+TOrRjgHX1k1QnzQ+9IAEdaANKm9rzMGAL8X2VZQ+8wF2bw==,iv:ZQXtSAN9SgV34+IqJgBIHdGSJO48KnOUlAdbF71u6hU=,tag:JkIjHisf6z01FcKZ+k0kjg==,type:str]
 proxmox_username: ENC[AES256_GCM,data:PSo+m9+C8pc=,iv:zgIuuDfWqwxEewaulUGk72TdqChFRLH6erSOe2lmQrY=,tag:DV/Pig+eWtjtCPi7x7ZAKg==,type:str]
 proxmox_password: ENC[AES256_GCM,data:eUem748XtcNfrF5kGjz+H7ge,iv:ap3WlszfqS1weQKPOg2zPfC9mimiiSpfyqJhpMboHVM=,tag:rbpCwI2VTT+nws5fNTu9zw==,type:str]
 sops:
@@ -15,7 +16,7 @@ sops:
             WE41Mk9SRDlnNG5KTTFYT0pqclZISzAKKvYxrXkxVRB7KJFvADUIgh3lVwJTFaiz
             Y4ww84MOhWmlivqJ4XFOqxa3XA7qQLemSUdOIptdg5XQwZiVnW1F0A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-08T16:02:45Z"
-    mac: ENC[AES256_GCM,data:3g2lVSjjbP2Azbj8nIn/7Rbb8v7TUCmpYHaNqB1WEIfyL3/zXQU4UyxGxjbjkLLRB1KHdbDm7qPbiSWK+mSp2Fb3KGhMjfRfEkXaVgEanYmjvb+1WYpEqxEOMSxDAMSOXdMkz1zV2pPI2rvdSUXCsZ/Jt8kx/Tfy5CV/HC21/LI=,iv:xRNHg6Ec8zMpZX6vGhJTpp3gQxq+37c3Fc8Z6el2huc=,tag:464MPZHPv/mQTBCcb0Z8QQ==,type:str]
+    lastmodified: "2026-03-08T16:07:31Z"
+    mac: ENC[AES256_GCM,data:NIAPBM05x0f3ruxHNZEaERuBnurypBMIL8QNVXHa2FNuxwdnhoxdmsr82L2vuLNHRr0chmDp60P1RlncafMewX3tJAJ+l/ud4XmVN5NGXp/WFw3LIidza3jmKJt1h5Wl9rZUqS55fSOfRA1iNh1TTPQ92/Gllcs+lfqM6cCoE+s=,iv:hB1fiKipnSjvUatcu6+bRjjQKZxdllCCKwyI/Voy4qo=,tag:GoZ0TnmwEx7xmFvVMouBng==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0