diff --git a/modules/core.nix b/modules/core.nix
index b4ec8e1..dbceb2d 100644
--- a/modules/core.nix
+++ b/modules/core.nix
@@ -73,6 +73,12 @@ in
       description = "Path to wallpaper for automatic color generation";
     };
 
+    # Secrets management (sops-nix). Opt-in: when false (default) the host
+    # carries no secrets and sops stays inert, so a fresh fork builds and
+    # runs with zero secret setup. Enable it AND provide secrets/omni.yaml
+    # (see secrets/omni.yaml.example + modules/secrets.nix) to activate.
+    secrets.enable = mkEnableOption "sops-nix age-encrypted secrets for this host";
+
     # Feature Categories - Simple on/off switches for major functionality
     features = {
       # Development
diff --git a/modules/secrets.nix b/modules/secrets.nix
index 5ae3d83..9d47d8d 100644
--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -9,15 +9,21 @@
 # in the module that consumes them.
 #
 # Recipients live in /etc/nixos/.sops.yaml; the matching age key
-# lives at ~/.config/sops/age/keys.txt on omni/bohm.
+# lives at ~/.config/sops/age/keys.txt on the host's primary user.
+#
+# Activation is doubly guarded: `omni.secrets.enable` (explicit opt-in,
+# default false) AND the encrypted file actually existing. A fork that
+# wants no secrets leaves the flag off and never touches sops; one that
+# enables it but hasn't created secrets/omni.yaml yet still evaluates.
 
 let
+  cfg = config.omni;
   sopsFile = ../secrets/omni.yaml;
 in
 {
-  sops = lib.mkIf (builtins.pathExists sopsFile) {
+  sops = lib.mkIf (cfg.secrets.enable && builtins.pathExists sopsFile) {
     defaultSopsFile = sopsFile;
     defaultSopsFormat = "yaml";
-    age.keyFile = "/home/padreug/.config/sops/age/keys.txt";
+    age.keyFile = "/home/${cfg.user}/.config/sops/age/keys.txt";
   };
 }