diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..9a4ad8b
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,11 @@
+keys:
+  - &primary age1xkwq2edchgu3taf2tlvraajxmgymn4vxtnpvl6ywlsswtqcp5sfswv2gzt
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+    - age:
+      - *primary
+  - path_regex: secrets/authentik.env$
+    key_groups:
+    - age:
+      - *primary