diff --git a/flake.lock b/flake.lock
index 609331d..213f461 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": [],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1680281360,
+        "narHash": "sha256-XdLTgAzjJNDhAG2V+++0bHpSzfvArvr2pW6omiFfEJk=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "e64961977f60388dd0b49572bb0fc453b871f896",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -73,6 +94,7 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "deploy-rs": "deploy-rs",
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
diff --git a/flake.nix b/flake.nix
index 4b9f6d9..0eb3487 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,26 +1,30 @@
 {
   description = "motiejus/config";
 
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11-small";
+    flake-utils.url = "github:numtide/flake-utils";
+
+    agenix.url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    agenix.inputs.darwin.follows = "";
+
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy-rs.inputs.utils.follows = "flake-utils";
+
+  };
+
   nixConfig = {
     trusted-substituters = "https://cache.nixos.org/";
     trusted-public-keys = "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=";
     extra-experimental-features = "nix-command flakes";
   };
 
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11-small";
-
-    deploy-rs.url = "github:serokell/deploy-rs";
-    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-    deploy-rs.inputs.utils.follows = "flake-utils";
-
-    flake-utils.url = "github:numtide/flake-utils";
-
-  };
-
   outputs = {
     self,
     nixpkgs,
+    agenix,
     deploy-rs,
     flake-utils,
   }: let
@@ -33,6 +37,8 @@
           ./configuration.nix
           ./hardware-configuration.nix
           ./zfs.nix
+
+          agenix.nixosModules.default
         ];
       };
 
@@ -55,7 +61,11 @@
     in {
       devShells.default = with pkgs;
         mkShell {
-          packages = [deploy-rs.packages.x86_64-linux.deploy-rs];
+          packages = [
+              pkgs.age
+              agenix.packages.${system}.agenix
+              deploy-rs.packages.${system}.deploy-rs
+          ];
         };
 
       formatter = pkgs.alejandra;