diff --git a/spindle/xrpc/add_secret.go b/spindle/xrpc/add_secret.go
index 162412c6..5868fe40 100644
--- a/spindle/xrpc/add_secret.go
+++ b/spindle/xrpc/add_secret.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/syntax"
@@ -76,9 +77,10 @@ func (x *Xrpc) AddSecret(w http.ResponseWriter, r *http.Request) {
 		Repo:      secrets.DidSlashRepo(didPath),
 		Key:       data.Key,
 		Value:     data.Value,
+		CreatedAt: time.Now(),
 		CreatedBy: actorDid,
 	}
-	err = x.Vault.AddSecret(secret)
+	err = x.Vault.AddSecret(r.Context(), secret)
 	if err != nil {
 		l.Error("failed to add secret to vault", "did", actorDid.String(), "err", err)
 		writeError(w, GenericError(err), http.StatusInternalServerError)
diff --git a/spindle/xrpc/list_secrets.go b/spindle/xrpc/list_secrets.go
index 3cdc762e..1e84de7b 100644
--- a/spindle/xrpc/list_secrets.go
+++ b/spindle/xrpc/list_secrets.go
@@ -68,7 +68,7 @@ func (x *Xrpc) ListSecrets(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	ls, err := x.Vault.GetSecretsLocked(secrets.DidSlashRepo(didPath))
+	ls, err := x.Vault.GetSecretsLocked(r.Context(), secrets.DidSlashRepo(didPath))
 	if err != nil {
 		l.Error("failed to get secret from vault", "did", actorDid.String(), "err", err)
 		writeError(w, GenericError(err), http.StatusInternalServerError)
diff --git a/spindle/xrpc/remove_secret.go b/spindle/xrpc/remove_secret.go
index 659bc0be..a7fb7e08 100644
--- a/spindle/xrpc/remove_secret.go
+++ b/spindle/xrpc/remove_secret.go
@@ -71,7 +71,7 @@ func (x *Xrpc) RemoveSecret(w http.ResponseWriter, r *http.Request) {
 		Repo: secrets.DidSlashRepo(didPath),
 		Key:  data.Key,
 	}
-	err = x.Vault.RemoveSecret(secret)
+	err = x.Vault.RemoveSecret(r.Context(), secret)
 	if err != nil {
 		l.Error("failed to remove secret from vault", "did", actorDid.String(), "err", err)
 		writeError(w, GenericError(err), http.StatusInternalServerError)