diff --git a/secrets/README.md b/secrets/README.md
new file mode 100644
index 0000000..64e0ebb
--- /dev/null
+++ b/secrets/README.md
@@ -0,0 +1,38 @@
+# Secrets (agenix)
+
+This directory holds [agenix](https://github.com/ryantm/agenix)-encrypted secrets.
+
+## Workflow
+
+1. Generate an age keypair if you don't have one:
+   ```bash
+   mkdir -p ~/.config/agenix
+   age-keygen -o ~/.config/agenix/key.txt
+   ```
+
+2. Add your public key to `secrets.nix`:
+   ```nix
+   let
+     yourKey = "age1...";
+   in
+   {
+     "my-secret.txt".publicKeys = [ yourKey ];
+   }
+   ```
+
+3. Edit/create the secret:
+   ```bash
+   agenix -e my-secret.txt
+   ```
+
+4. Reference the decrypted secret in your NixOS config:
+   ```nix
+   age.secrets.my-secret = {
+     file = ./my-secret.txt;
+     owner = "mollyw";
+   };
+   ```
+
+5. Access at runtime via `/run/secrets/my-secret`
+
+No secrets are configured yet — this is scaffolding for future use.
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..5b97fc6
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,7 @@
+# Agenix secrets configuration
+# Add age-encrypted secrets here following the agenix workflow:
+# https://github.com/ryantm/agenix
+#
+# Example:
+#   "secret.txt" = { publicKeys = [ sshKey1 sshKey2 ]; };
+{}
diff --git a/treefmt.nix b/treefmt.nix
new file mode 100644
index 0000000..c840226
--- /dev/null
+++ b/treefmt.nix
@@ -0,0 +1,6 @@
+{ ... }: {
+  projectRootFile = "flake.nix";
+  programs.alejandra.enable = true;
+  programs.statix.enable = true;
+  programs.deadnix.enable = true;
+}