diff --git a/.sops.yaml.example b/.sops.yaml.example
new file mode 100644
index 0000000..072ae08
--- /dev/null
+++ b/.sops.yaml.example
@@ -0,0 +1,13 @@
+keys:
+  # Your age PUBLIC key. Generate a keypair with:
+  #   age-keygen -o ~/.config/sops/age/keys.txt
+  # then paste the "Public key:" line below (starts with "age1...").
+  # Copy this file to .sops.yaml and fill it in.
+  # pragma: allowlist secret
+  - &admin age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY
+
+creation_rules:
+  - path_regex: secrets/.*\.yaml$
+    key_groups:
+      - age:
+          - *admin
diff --git a/modules/secrets.nix b/modules/secrets.nix
new file mode 100644
index 0000000..5ae3d83
--- /dev/null
+++ b/modules/secrets.nix
@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+# sops-nix per-host wiring.
+#
+# The sops-nix module itself is injected by lib/mksystem.nix. This
+# file points sops at the omni default file and the host's age
+# key. Secrets are exposed to services as files under
+# /run/secrets/<name>, declared per-secret via `sops.secrets.<name>`
+# in the module that consumes them.
+#
+# Recipients live in /etc/nixos/.sops.yaml; the matching age key
+# lives at ~/.config/sops/age/keys.txt on omni/bohm.
+
+let
+  sopsFile = ../secrets/omni.yaml;
+in
+{
+  sops = lib.mkIf (builtins.pathExists sopsFile) {
+    defaultSopsFile = sopsFile;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/home/padreug/.config/sops/age/keys.txt";
+  };
+}
diff --git a/secrets/README.md b/secrets/README.md
new file mode 100644
index 0000000..34d033c
--- /dev/null
+++ b/secrets/README.md
@@ -0,0 +1,37 @@
+# omni secrets (sops-nix)
+
+Encrypted YAML files in this directory are decrypted at NixOS
+activation time and exposed under `/run/secrets/<name>` for the
+services that declare `sops.secrets.<name>` to consume.
+
+Recipients are declared in `../.sops.yaml`. On omni/bohm the
+matching private key lives at `~/.config/sops/age/keys.txt`.
+
+## Workflow
+
+```bash
+# First-time: create + encrypt the omni default file
+sops secrets/omni.yaml
+# adds the sops: metadata block and encrypts in place
+
+# Later edits go through sops (auto-decrypts, re-encrypts on save)
+sops secrets/omni.yaml
+```
+
+## First migration targets
+
+See `../modules/mcp.nix` for the current plaintext-file references
+that should move under sops:
+
+- `forgejo-token` — Forgejo personal access token (forgejo-mcp)
+- `lnbits-admin-key` — LNbits admin API key (lnbits-mcp)
+
+Once `secrets/omni.yaml` exists and is encrypted, declare each in
+the consuming module:
+
+```nix
+sops.secrets.forgejo-token = { mode = "0400"; owner = config.omni.user; };
+```
+
+and switch the path reference (e.g. `forgejoTokenFile`) to
+`config.sops.secrets.forgejo-token.path`.
diff --git a/secrets/omni.yaml.example b/secrets/omni.yaml.example
new file mode 100644
index 0000000..8e10752
--- /dev/null
+++ b/secrets/omni.yaml.example
@@ -0,0 +1,12 @@
+# Template secrets file. Copy to secrets/omni.yaml, then encrypt in
+# place with sops (uses the recipient in ../.sops.yaml):
+#
+#   cp secrets/omni.yaml.example secrets/omni.yaml
+#   sops secrets/omni.yaml
+#
+# modules/secrets.nix only activates sops when omni.secrets.enable is
+# set AND this file exists, so the config evaluates fine without it.
+# Keys below are examples the modules consume — adjust to taste.
+forgejo-token: REPLACE_ME
+lnbits-admin-key: REPLACE_ME
+nextcloud-password: REPLACE_ME