diff --git a/systems/x86_64-linux/marvin/services/git.nix b/systems/x86_64-linux/marvin/services/git.nix
index 4917a0de..73395f2e 100644
--- a/systems/x86_64-linux/marvin/services/git.nix
+++ b/systems/x86_64-linux/marvin/services/git.nix
@@ -119,31 +119,31 @@ in
   };
   age.secrets = {
     forgejo-db-pw = forgejoSecret // {
-      file = ./secrets/forgejo-db-pw.age;
+      file = ./secrets/forgejo/db-pw.age;
     };
     forgejo-mail-pw = forgejoSecret // {
-      file = ./secrets/forgejo-mail-pw.age;
+      file = ./secrets/forgejo/mail-pw.age;
     };
     forgejo-aux-docs-runner-token = forgejoSecret // {
-      file = ./secrets/forgejo-aux-docs-runner-token.age;
+      file = ./secrets/forgejo/aux-docs-runner-token.age;
     };
     forgejo-default-runner-token = forgejoSecret // {
-      file = ./secrets/forgejo-default-runner-token.age;
+      file = ./secrets/forgejo/default-runner-token.age;
     };
     forgejo-gitgay-runner-token = forgejoSecret // {
-      file = ./secrets/forgejo-gitgay-runner-token.age;
+      file = ./secrets/forgejo/gitgay-runner-token.age;
     };
     forgejo-internal-token = forgejoSecret // {
-      file = ./secrets/forgejo-internal-token.age;
+      file = ./secrets/forgejo/internal-token.age;
     };
     forgejo-oauth2-jwt-secret = forgejoSecret // {
-      file = ./secrets/forgejo-oauth2-jwt-secret.age;
+      file = ./secrets/forgejo/oauth2-jwt-secret.age;
     };
     forgejo-lfs-jwt-secret = forgejoSecret // {
-      file = ./secrets/forgejo-lfs-jwt-secret.age;
+      file = ./secrets/forgejo/lfs-jwt-secret.age;
     };
     forgejo-secret-key = forgejoSecret // {
-      file = ./secrets/forgejo-secret-key.age;
+      file = ./secrets/forgejo/secret-key.age;
     };
   };
   services.anubis.instances.forgejo = {
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-aux-docs-runner-token.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/aux-docs-runner-token.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-aux-docs-runner-token.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/aux-docs-runner-token.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-db-pw.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/db-pw.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-db-pw.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/db-pw.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-default-runner-token.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/default-runner-token.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-default-runner-token.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/default-runner-token.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-gitgay-runner-token.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/gitgay-runner-token.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-gitgay-runner-token.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/gitgay-runner-token.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-internal-token.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/internal-token.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-internal-token.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/internal-token.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-lfs-jwt-secret.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/lfs-jwt-secret.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-lfs-jwt-secret.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/lfs-jwt-secret.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-mail-pw.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/mail-pw.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-mail-pw.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/mail-pw.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-oauth2-jwt-secret.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/oauth2-jwt-secret.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-oauth2-jwt-secret.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/oauth2-jwt-secret.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/forgejo-secret-key.age b/systems/x86_64-linux/marvin/services/secrets/forgejo/secret-key.age
similarity index 100%
rename from systems/x86_64-linux/marvin/services/secrets/forgejo-secret-key.age
rename to systems/x86_64-linux/marvin/services/secrets/forgejo/secret-key.age
diff --git a/systems/x86_64-linux/marvin/services/secrets/secrets.nix b/systems/x86_64-linux/marvin/services/secrets/secrets.nix
index 08411718..055ed319 100644
--- a/systems/x86_64-linux/marvin/services/secrets/secrets.nix
+++ b/systems/x86_64-linux/marvin/services/secrets/secrets.nix
@@ -15,15 +15,15 @@ in
   "buildbot-gitea-token.age".publicKeys = marvinDefault;
   "buildbot-oauth-secret.age".publicKeys = marvinDefault;
   "buildbot-workers.age".publicKeys = marvinDefault;
-  "forgejo-db-pw.age".publicKeys = marvinDefault;
-  "forgejo-mail-pw.age".publicKeys = marvinDefault;
-  "forgejo-aux-docs-runner-token.age".publicKeys = marvinDefault;
-  "forgejo-default-runner-token.age".publicKeys = marvinDefault;
-  "forgejo-gitgay-runner-token.age".publicKeys = marvinDefault;
-  "forgejo-internal-token.age".publicKeys = marvinDefault;
-  "forgejo-lfs-jwt-secret.age".publicKeys = marvinDefault;
-  "forgejo-oauth2-jwt-secret.age".publicKeys = marvinDefault;
-  "forgejo-secret-key.age".publicKeys = marvinDefault;
+  "forgejo/aux-docs-runner-token.age".publicKeys = marvinDefault;
+  "forgejo/db-pw.age".publicKeys = marvinDefault;
+  "forgejo/default-runner-token.age".publicKeys = marvinDefault;
+  "forgejo/gitgay-runner-token.age".publicKeys = marvinDefault;
+  "forgejo/internal-token.age".publicKeys = marvinDefault;
+  "forgejo/lfs-jwt-secret.age".publicKeys = marvinDefault;
+  "forgejo/mail-pw.age".publicKeys = marvinDefault;
+  "forgejo/oauth2-jwt-secret.age".publicKeys = marvinDefault;
+  "forgejo/secret-key.age".publicKeys = marvinDefault;
   "golink-authkey.age".publicKeys = marvinDefault;
   "grafana-admin-password.age".publicKeys = marvinDefault;
   "grafana-smtp-password.age".publicKeys = marvinDefault;