diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..d69905be
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.yaml diff=sopsdiffer
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 00000000..4e04cc3d
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,14 @@
+keys:
+  - &admin_nobbz age1wpwkf2g475umw3wwns57r8ucykvy6lflpc7uphs0mx9exsj04quqpy7t6r
+  - &host_mimas age10jl78vwyqk622dpn2890l9jl4et3p7lsr8wh8vusem3j8jdxle8qg000qa
+creation_rules:
+  - path_regex: secrets/[^/]+\.yaml$
+    key_groups:
+      - age:
+          - *admin_nobbz
+          - *host_mimas
+  - path_regex: secrets/mimas/[^/]+\.yaml$
+    key_groups:
+      - age:
+          - *admin_nobbz
+          - *host_mimas
diff --git a/nixos/configurations/mimas.nix b/nixos/configurations/mimas.nix
index d7101f0d..c42bf0e4 100644
--- a/nixos/configurations/mimas.nix
+++ b/nixos/configurations/mimas.nix
@@ -2,6 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 {
+  self,
   unstable,
   nixpkgs-2211,
   ...
@@ -20,6 +21,13 @@ in {
     (import ./mimas/paperless.nix inputs)
   ];
 
+  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+  sops.age.keyFile = "/home/nmelzer/.config/sops/age/keys.txt";
+  sops.defaultSopsFile = "${self}/secrets/mimas/default.yaml";
+
+  sops.secrets.restic = {};
+  sops.secrets.backblaze = {};
+
   nix.allowedUnfree = ["zerotierone"] ++ printerPackages ++ steamPackages;
   nix.settings.experimental-features = ["ca-derivations" "impure-derivations"];
 
diff --git a/nixos/configurations/mimas/restic.nix b/nixos/configurations/mimas/restic.nix
index c3e66d2a..106f32da 100644
--- a/nixos/configurations/mimas/restic.nix
+++ b/nixos/configurations/mimas/restic.nix
@@ -9,7 +9,6 @@
   inherit (pkgs) writeShellScript proot mount umount restic;
 
   pools = {
-    docker = "/var/lib/docker";
     gitea = "/var/lib/gitea";
     grafana = "/var/lib/grafana";
     paperless = "/var/lib/paperless";
@@ -41,7 +40,7 @@
   rest_repo = "rest:https://restic.mimas.internal.nobbz.dev/mimas";
   gdrv_repo = "/home/nmelzer/timmelzer@gmail.com/restic_repos/mimas";
   btwo_repo = "b2:nobbz-restic-services";
-  pass = "/home/nmelzer/.config/restic/password";
+  pass = config.sops.secrets.restic.path;
 
   script = writeShellScript "restic-services-backup" ''
     set -ex
@@ -114,9 +113,10 @@ in {
 
   systemd.services.restic-system-snapshot-sync-and-prune = {
     path = [restic];
+    after = ["run-secrets.d.mount"];
     serviceConfig.Type = "oneshot";
     serviceConfig.LoadCredential = [
-      "b2:/home/nmelzer/.config/restic/b2"
+      "b2:${config.sops.secrets.backblaze.path}"
       "pass:${pass}"
     ];
     script = ''
diff --git a/parts/auxiliary.nix b/parts/auxiliary.nix
index a65875e0..f2b932ef 100644
--- a/parts/auxiliary.nix
+++ b/parts/auxiliary.nix
@@ -12,7 +12,7 @@
     devShells.default = pkgs.mkShell {
       packages = builtins.attrValues {
         inherit (self'.packages) nil alejandra;
-        inherit (inputs'.unstable.legacyPackages) npins rust-analyzer rustc cargo rustfmt clippy openssl pkg-config;
+        inherit (inputs'.unstable.legacyPackages) npins rust-analyzer rustc cargo rustfmt clippy openssl pkg-config sops age ssh-to-age;
       };
     };
   };
diff --git a/secrets/mimas/default.yaml b/secrets/mimas/default.yaml
new file mode 100644
index 00000000..6183fe1a
--- /dev/null
+++ b/secrets/mimas/default.yaml
@@ -0,0 +1,31 @@
+restic: ENC[AES256_GCM,data:+4nwZVi6T3yd4Q==,iv:9NdaTuhLR57mv8OaCSyso9cfr8V1iQNuQuWInKyi3bI=,tag:ByjPvjpO9YQHzdSQ48UGxQ==,type:str]
+backblaze: ENC[AES256_GCM,data:d/LtXbUVd5d07c3GqEs5oRwQXLFqKapLxKcMGylExw6cDV6w4XtwCNBtm8ohSMd7X3xtHOWVV8W2MiE9KHsqTKk8jAIFOFMwG29k1qAXqiX2fVPUVtYCeezi5oBm+lynr+njNn8=,iv:kGHjUYWYpY5XBVr9EpPMwxaEsFFBwn+aMgmHScK9quo=,tag:WDVLzOqa9WMwmTSUz/DCYQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1wpwkf2g475umw3wwns57r8ucykvy6lflpc7uphs0mx9exsj04quqpy7t6r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1U0xXZjZDN090YkNRRSsw
+            YlBPR2lQMXM2aHZ4WHRoSjRMUFpmRWJjOHpvCmsrUDZkcFJpRWk5djEvWDJsRE5O
+            Zm9YdjlDY0VOYTJjRmJIMUl4OWVNbEUKLS0tIElvMERlamNBWjdFRkMzOC9RVnpo
+            TzJwdjNCRHVFeDNQZVZEM1JXd0hPUFUKQITfkwBEWM41s1396WfuZGbFyZf885t9
+            +uIQ53TAsmk1hv4noW4tE4d0AFbwE5vgWkFP205Ciq7r6uOkL+wOeg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10jl78vwyqk622dpn2890l9jl4et3p7lsr8wh8vusem3j8jdxle8qg000qa
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbWQ5QUg2RWRISjIrR2Y3
+            VmZnT0N2SDVPSU5EdFNIT0YvVXF4RUhCNzFFCnFsSDE0OVNWVGFMOWdlVVIwaTh0
+            cGpya1FMQTdsNlNYNjNUWTNNWVhQM3MKLS0tIFhoU1AvRjBwckxPbE84bW55Y3c3
+            WTVUbzgrNmwycFUraHBzUlZWR3VCQ1UK27oYZV02fKzJ1sbqtpwnDhmBlkCNo67l
+            S3HLuh+/rEp4xDUVY6Zcs8ua/u5iSzo0whvUBTYPF6BCVW7/3xL8ww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-02-23T21:11:49Z"
+    mac: ENC[AES256_GCM,data:qTpbgZ8ZpqbhW8TJul5dVUXur2ZK3SbzJ3wE0b2albjqVz+Y22TIhQAQKDZ8OHGvROVO9B+yKHY9xt54Pth4dpjJftbnhbnmcEZCxG5BybKbBiA5u1sFs7I9EffrM4qgYGugC8tTz/JNNQmRfCAQPjkEKb7i1LB0pYyEop0EKB8=,iv:N2oBn0uGyUKmX+mkdlrrVquDWcTpEjSiNU596R3gm90=,tag:EowbJbM/FVj+e7+wOtGDhw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3