diff --git a/infra/_modules/nixos/.sops.yaml b/infra/_modules/nixos/.sops.yaml
index 65ee661..8b8facd 100644
--- a/infra/_modules/nixos/.sops.yaml
+++ b/infra/_modules/nixos/.sops.yaml
@@ -3,5 +3,7 @@ creation_rules:
   # - run age-keygen
   # - copy public key here
   # - copy private key to ~/.config/sops/age/keys.txt
+  # TODO fix this shit and don't share secrets between staging and prod
   - age: >-
-      age15c5rpksj0u27sp667525zqh8dhtd70rwrlv7xq2hqhsfaempcdwqu3unel
+      age15c5rpksj0u27sp667525zqh8dhtd70rwrlv7xq2hqhsfaempcdwqu3unel,
+      age1j9vhx20vkmepd4e7tze5dc6f2lm4gt4wa7zskhcq2k9xw93c8e3qvpd4dx
diff --git a/infra/_modules/nixos/secrets.yaml b/infra/_modules/nixos/secrets.yaml
index de98ed6..f3338a3 100644
--- a/infra/_modules/nixos/secrets.yaml
+++ b/infra/_modules/nixos/secrets.yaml
@@ -1,16 +1,25 @@
 k3s_token: ENC[AES256_GCM,data:Gkpz+zgUN4qHacbB52LOoVB4cm1OM7MrsEmKbqRvaukRnh4ctvBDd+9C+6fnOQsTNw==,iv:VD/YnqtVnu7PCGoGFCzzt8WrBAa6bdluNrRDO/YP2RA=,tag:+wu5MiCbMELVaIrEcK0KIQ==,type:str]
 sops:
-  age:
-    - recipient: age15c5rpksj0u27sp667525zqh8dhtd70rwrlv7xq2hqhsfaempcdwqu3unel
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArSUFnczNDTzl1Mm8wVWdN
-        NnZCN2hJa3JMOW42Mno0UGZod3hYMjhvWm5nCkpqRklwRSt6Sm9NWFA3aFEvYncv
-        QjFqRng3TVhVRERDUkZwNTV2YThocTgKLS0tIGoyc0oxbU5FenhHVVJZTXpkSlhC
-        eFpDWWg4Z2dWc3JvV2l0Q2Evd25mSTAKfZn8kohXG6O7y54dPpSXhRj1E75XGZDj
-        CRxObtI2s+ddACiHzNVDuDJkq5RForvOYwR/6nk6jEdIQt8pfnwiSA==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2025-08-27T13:36:25Z"
-  mac: ENC[AES256_GCM,data:uEdpYAK1kygA3ZlM7ZfNE11RxaPDCPthHf3orHZgeBSfCsoBERtvfh9eqc6SdAFSkd8gXRViy38Yt8q0Y/9aRvfz1/sBX2wnUkB8VDYzlZDUr1Aj4BYGetXlgfHPzuD131NtsbcXmU6X7K+xAT6vFLqrnB5uvhPG9w6ZNYxSEOw=,iv:f0kGlZ0dLkOoJg4A2AWnNAnZPBydghI6gyZUR7jmYh4=,tag:KU3J8cGZjrk/xaUokqmuXg==,type:str]
-  unencrypted_suffix: _unencrypted
-  version: 3.10.2
+    age:
+        - recipient: age15c5rpksj0u27sp667525zqh8dhtd70rwrlv7xq2hqhsfaempcdwqu3unel
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UTkrSlc1ZSt0Tkcvc1p0
+            M2htSnh2ZW9oMkp6QS8vNTE2M3lMSHl1Snc4CjBrR2dpSEVFcW9FbUdNOEZHSXg5
+            bGZCUkVtdSttRkRTQXBXUVUzMFB0aFEKLS0tIGtDMkdYL25tRzIvU0NyNXV1MHNr
+            RUlXSXNZTm04YlR3VzQ2WDlScHhYQVkKkZgeiKeW5v31ncByE5/cS2e+5UdLN9+P
+            a8dKkKemstBB3V08V97EEz/67KIKJZ+BsLRCR+cxgLutPKYRkf2vjQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1j9vhx20vkmepd4e7tze5dc6f2lm4gt4wa7zskhcq2k9xw93c8e3qvpd4dx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzVmhaR200dDlHRm8zVHNt
+            K1FFYkhPSkl0c3VxeGVZZEhUcDZiL1J3eEhrCjF4RXpRZnphWnZlZjRnbHNvTzdp
+            WEt2a0tDa1lMWVlNcW1wVlROdVRldW8KLS0tIHlMUFJPa01JWFljU2J3NFJsWnBz
+            UXplUVdXK2UwWThwWFVCZXFIbDdDejAKgnEcvwGTnHr32i2vka7ukpyFpE9Wc4DR
+            1+h2gogHZxpQGpKjW8ufapjknOxegBw8IgisWWEGKnOeGuYEW1Dcfg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-08-27T13:36:25Z"
+    mac: ENC[AES256_GCM,data:uEdpYAK1kygA3ZlM7ZfNE11RxaPDCPthHf3orHZgeBSfCsoBERtvfh9eqc6SdAFSkd8gXRViy38Yt8q0Y/9aRvfz1/sBX2wnUkB8VDYzlZDUr1Aj4BYGetXlgfHPzuD131NtsbcXmU6X7K+xAT6vFLqrnB5uvhPG9w6ZNYxSEOw=,iv:f0kGlZ0dLkOoJg4A2AWnNAnZPBydghI6gyZUR7jmYh4=,tag:KU3J8cGZjrk/xaUokqmuXg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2