diff --git a/hosts/tsumugi/arr/default.nix b/hosts/tsumugi/arr/default.nix
index 1681c7d..3137ede 100644
--- a/hosts/tsumugi/arr/default.nix
+++ b/hosts/tsumugi/arr/default.nix
@@ -13,8 +13,8 @@
     ./sonarrMain.nix
   ];
 
-  sops.secrets."tsumugi/autobrrSecret" = { };
-  sops.secrets."tsumugi/autobrrEnv" = { };
+  sops.secrets."tsumugi/autobrrSecret".restartUnits = [ "autobrr.service" ];
+  sops.secrets."tsumugi/autobrrEnv".restartUnits = [ "autobrr.service" ];
   sops.secrets."tsumugi/bandcampCookies" = {
     owner = config.users.users.bandcampsync.name;
     restartUnits = [ "bandcampsync.service" ];
@@ -61,22 +61,6 @@
 
     recyclarr.enable = true;
 
-    autobrr = {
-      enable = true;
-      openFirewall = false;
-      secretFile = config.sops.secrets."tsumugi/autobrrSecret".path;
-      settings = {
-        host = "0.0.0.0";
-        port = 7474;
-        oidcEnabled = true;
-        oidcIssuer = "https://auth.moppu.dev";
-        oidcRedirectUrl = "https://autobrr.moppu.dev/api/auth/oidc/callback";
-        oidcDisableBuiltInLogin = true;
-      };
-    };
-    systemd.services.autobrr.serviceConfig.EnvironmentFile =
-      config.sops.secrets."tsumugi/autobrrEnv".path;
-
     bandcampsync = {
       enable = true;
       settings = {
@@ -89,4 +73,20 @@
       };
     };
   };
+
+  services.autobrr = {
+    enable = true;
+    openFirewall = false;
+    secretFile = config.sops.secrets."tsumugi/autobrrSecret".path;
+    settings = {
+      host = "0.0.0.0";
+      port = 7474;
+      oidcEnabled = true;
+      oidcIssuer = "https://auth.moppu.dev";
+      oidcRedirectUrl = "https://autobrr.moppu.dev/api/auth/oidc/callback";
+      oidcDisableBuiltInLogin = true;
+    };
+  };
+  systemd.services.autobrr.serviceConfig.EnvironmentFile =
+    config.sops.secrets."tsumugi/autobrrEnv".path;
 }
diff --git a/hosts/tsumugi/arr/radarrAnime.nix b/hosts/tsumugi/arr/radarrAnime.nix
index 99df708..4890a1a 100644
--- a/hosts/tsumugi/arr/radarrAnime.nix
+++ b/hosts/tsumugi/arr/radarrAnime.nix
@@ -28,15 +28,11 @@ in
     };
   };
 
-  sops.secrets."tsumugi/radarrAnimeApiKey" = { };
-
-  systemd.services.recyclarr.serviceConfig.LoadCredential = [
-    "radarrAnimeApiKey:${config.sops.secrets."tsumugi/radarrAnimeApiKey".path}"
-  ];
+  sops.secrets."tsumugi/radarrAnimeApiKey".restartUnits = [ "recyclarr.service" ];
 
   services.recyclarr.configuration.radarr.radarrAnime = {
     base_url = "http://localhost:7887";
-    api_key._secret = "/run/credentials/recyclarr.service/radarrAnimeApiKey";
+    api_key._secret = config.sops.secrets."tsumugi/radarrAnimeApiKey".path;
     delete_old_custom_formats = true;
     replace_existing_custom_formats = true;
     quality_definition.type = "anime";
diff --git a/hosts/tsumugi/arr/radarrMain.nix b/hosts/tsumugi/arr/radarrMain.nix
index 29e1bbf..ec780ea 100644
--- a/hosts/tsumugi/arr/radarrMain.nix
+++ b/hosts/tsumugi/arr/radarrMain.nix
@@ -18,15 +18,11 @@ in
     settings.auth.method = "External";
   };
 
-  sops.secrets."tsumugi/radarrMainApiKey" = { };
-
-  systemd.services.recyclarr.serviceConfig.LoadCredential = [
-    "radarrMainApiKey:${config.sops.secrets."tsumugi/radarrMainApiKey".path}"
-  ];
+  sops.secrets."tsumugi/radarrMainApiKey".restartUnits = [ "recyclarr.service" ];
 
   services.recyclarr.configuration.radarr.radarrMain = {
     base_url = "http://localhost:7878";
-    api_key._secret = "/run/credentials/recyclarr.service/radarrMainApiKey";
+    api_key._secret = config.sops.secrets."tsumugi/radarrMainApiKey".path;
     delete_old_custom_formats = true;
     replace_existing_custom_formats = true;
     quality_definition.type = "movie";
diff --git a/hosts/tsumugi/arr/sonarrAnime.nix b/hosts/tsumugi/arr/sonarrAnime.nix
index 7c828f4..ccc5fcf 100644
--- a/hosts/tsumugi/arr/sonarrAnime.nix
+++ b/hosts/tsumugi/arr/sonarrAnime.nix
@@ -24,15 +24,11 @@ in
     };
   };
 
-  sops.secrets."tsumugi/sonarrAnimeApiKey" = { };
-
-  systemd.services.recyclarr.serviceConfig.LoadCredential = [
-    "sonarrAnimeApiKey:${config.sops.secrets."tsumugi/sonarrAnimeApiKey".path}"
-  ];
+  sops.secrets."tsumugi/sonarrAnimeApiKey".restartUnits = [ "recyclarr.service" ];
 
   services.recyclarr.configuration.sonarr.sonarrAnime = {
     base_url = "http://localhost:8998";
-    api_key._secret = "/run/credentials/recyclarr.service/sonarrAnimeApiKey";
+    api_key._secret = config.sops.secrets."tsumugi/sonarrAnimeApiKey".path;
     delete_old_custom_formats = true;
     replace_existing_custom_formats = true;
     quality_definition.type = "anime";
diff --git a/hosts/tsumugi/arr/sonarrMain.nix b/hosts/tsumugi/arr/sonarrMain.nix
index 6c82303..e6a1d64 100644
--- a/hosts/tsumugi/arr/sonarrMain.nix
+++ b/hosts/tsumugi/arr/sonarrMain.nix
@@ -17,15 +17,11 @@ in
     openFirewall = false; # 8989
   };
 
-  sops.secrets."tsumugi/sonarrMainApiKey" = { };
-
-  systemd.services.recyclarr.serviceConfig.LoadCredential = [
-    "sonarrMainApiKey:${config.sops.secrets."tsumugi/sonarrMainApiKey".path}"
-  ];
+  sops.secrets."tsumugi/sonarrMainApiKey".restartUnits = [ "recyclarr.service" ];
 
   services.recyclarr.configuration.sonarr.sonarrMain = {
     base_url = "http://localhost:8989";
-    api_key._secret = "/run/credentials/recyclarr.service/sonarrMainApiKey";
+    api_key._secret = config.sops.secrets."tsumugi/sonarrMainApiKey".path;
     delete_old_custom_formats = true;
     replace_existing_custom_formats = true;
     quality_definition.type = "series";
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 4a2fd52..f109260 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -9,7 +9,7 @@ tsumugi:
     transmissionwgpk: ENC[AES256_GCM,data:qcV7E4am5kyg0Es4z98F8pECwbrnnw4J+wKIPkCuvGFEsR7g2ASBCqLlzs0=,iv:Pga7HS8+ZjNnghfx+GmQatLUBqL2pt5rt1VmGddkZDw=,tag:yKv92JQ0YAKlHu3JB2xpKw==,type:str]
     transmission: ENC[AES256_GCM,data:lUOP1FgucJ/Qi2nCx3SlZ5X36akHdHKa9ZA1H0JuBrqbyxAogRQJayLd606QNk8QE5Cecrg+el9/njKawWfB,iv:qpHSlLVKskSwW33iOwvINNnEidbQGqxBNjDdzNF7Y7Y=,tag:f7+mPCIvGqBA3t8EfATAew==,type:str]
     autobrrSecret: ENC[AES256_GCM,data:F3WlaDlhlzFL6ix/stAZIg==,iv:j4EaVIRc6LhqwIGbCEzEFGzKqOd/cfvSI/DgFoAlzDk=,tag:JmpWL0CNydnuluO7x9SRwg==,type:str]
-    autobrrEnv: ENC[AES256_GCM,data:QilX5sm8Fc+DSGBZuxa/dU6UtYQmPr/niRJUofR1Dm0odh7GCviwBu2S,iv:htjPOBGq0OFa+Ji5AKQC6/3lnpjCp2bKZqInf98SD+E=,tag:oYElFz9+sNj4coM7el5jEQ==,type:str]
+    autobrrEnv: ENC[AES256_GCM,data:FEYeU8Q1bH/VJBECkk9+Xa7VEHd5QyOywbgFN/1rJSGo97mjnlm6T2z+jfzBZUfAWw93+w39SARKgrU84ENJE/fP0USwd+t4EiduupNkRaMbL7EJxFKtSi1dICHh8nLf9qIUTAIQfE9XbNP1o9LQ2IdFj91z7b27akDc1orStJcfgdvOMWd8Wg==,iv:TR7rRAvTgSdQwczfxjW/QsUcH4SmfYuju0ZWhrI0HD4=,tag:cZwT7bWKYYapkGMwmVLYAQ==,type:str]
     nutPass: ENC[AES256_GCM,data:jCJ9IEdtRVPy1NfcHUIwqnQ3rsc=,iv:Zafd/x8TOyWwKHAcGK41hZeWu/krb1ErzUo1ei2JqcA=,tag:WZfDmzVIsJ6hQ9Z+UfCvjg==,type:str]
     radarrMainApiKey: ENC[AES256_GCM,data:KX6ISlzv0DDdAOGUGAgHOoLGrv0Z0mo9KTz7W0BprlY=,iv:bb5CgT874g+5ExlSjCFnMFcp34LSkzGvmh6JdZ85pKs=,tag:9BR2O9SDPjsZ22xm6ADxRw==,type:str]
     radarrAnimeApiKey: ENC[AES256_GCM,data:Dn9LmPjgmGYlIoi0nV760R8v5nbu0iVtEO5rhgkpDGA=,iv:17YeBObcUP+AmAB2DHHRvgRZNfe2TdQ6+IsWV7qYqS8=,tag:1KLlrXSHM5CKZKP02KFSrw==,type:str]
@@ -78,7 +78,7 @@ sops:
             JFaroA1RPAmhCC0nSl4seBSIuRl8QrPjfcBJy4mFycll5Mp/0/WwLA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpqgsevvfgk0nnmxacsdcwsrkefd0xcx7wkdlyaqj8vgvfvnm4rq4npjv6
-    lastmodified: "2026-08-20T12:59:45Z"
-    mac: ENC[AES256_GCM,data:DXCfq+Y0HNtPek7LGZ95JpvcjTlC9whqHdY+nns+xf5RXdOXTsSgFa6Wvdoh+HmPXQevaFg+XD4y8YMXIv4aXpE8Uw9so9gf4cxna1sK3FP7jzCtmr2ZJiQZTq/uFkBSwr09EAGqwUBOMxLMxEGEv6R+6oeUTn6C/3NCPhWKfQM=,iv:FD5+8apdl84VvWYj4SZRV0PbHwlU9UXwgzfrC31nIE0=,tag:5wRmBVUpgFUJQhX9qL9Kjw==,type:str]
+    lastmodified: "2026-08-20T13:10:43Z"
+    mac: ENC[AES256_GCM,data:KI0CrrlltBxKS46AxcGNsPsrgc0Njua2gmF7sX+z6hKi5U/JEZQzwnHGB0SCvDDTdds6lT6/G3L7URv0rEqP+ih0kgsWVs7ICUSbYV5X8YzcnwYdQTvOAN5iDidbnddgIbyUWP25Yn9xbaXZIjyKK5JLBmZ6pfUGfTSjVIfoxS8=,iv:9doFqYd5J+ds2uotiNZWEADJqz+ejSkb9aqxAj+USnY=,tag:vGlCMZuG3LncyiELqiqFsA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3