diff --git a/home/darwin/default.nix b/home/darwin/default.nix
index fbd4bb40..289f8c84 100644
--- a/home/darwin/default.nix
+++ b/home/darwin/default.nix
@@ -14,24 +14,6 @@
   home.homeDirectory = "/Users/anishlakhwara";
   home.stateVersion = "22.05";
 
-  # networking.wg-quick.interfaces = {
-  #   wg0 = {
-  #     address = [ "10.0.69.7/24" ];
-  #     listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
-  #     privateKeyFile = "/run/agenix/work-wg";
-  #     peers = [
-  #       # For a client configuration, one peer entry for the server will suffice.
-  #       {
-  #         publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
-  #         allowedIPs = [ "10.0.69.0/24" ];
-  #         # Set this to the server IP and port.
-  #         endpoint = "sealight.xyz:60990"; # TODO: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
-  #         persistentKeepalive = 25;
-  #       }
-  #     ];
-  #   };
-  # };
-
   programs.zsh.initExtra = ''
     PATH=/Users/anishlakhwara/.sourcegraph/bin:/Users/anishlakhwara/.sourcegraph/sg.zsh_autocomplete:/Users/anishlakhwara/google-cloud-sdk/bin:/Users/anishlakhwara/google-cloud-sdk/completion.zsh.inc:/Users/anishlakhwara/google-cloud-sdk/path.zsh.inc:/Users/anishlakhwara/.sg:/opt/homebrew/bin:$PATH
     '';
diff --git a/hosts/darwin/default.nix b/hosts/darwin/default.nix
index b32b8fce..62483a67 100644
--- a/hosts/darwin/default.nix
+++ b/hosts/darwin/default.nix
@@ -1,4 +1,4 @@
-{ self, pkgs, ... }:
+{ self, pkgs, config, ... }:
 
 {
   imports = [
@@ -18,25 +18,27 @@
     pkgs.kubernetes-helm
   ];
 
-  # age.secrets.curve-wg.file = "${self}/secrets/work-wg.age";
-  # age.secrets.curve-wg.owner = "anishlakhwara";
-  # networking.wg-quick.interfaces = {
-  #   wg0 = {
-  #     address = [ "10.0.69.7/24" ];
-  #     listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
-  #     privateKeyFile = "/run/agenix/work-wg";
-  #     peers = [
-  #       # For a client configuration, one peer entry for the server will suffice.
-  #       {
-  #         publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
-  #         allowedIPs = [ "10.0.69.0/24" ];
-  #         # Set this to the server IP and port.
-  #         endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
-  #         persistentKeepalive = 25;
-  #       }
-  #     ];
-  #   };
-  # };
+  age.identityPaths = [ "/Users/anishlakhwara/.ssh/id_ed25519" ];
+  age.secrets.work-wg.file = "${self}/secrets/work-wg.age";
+  age.secrets.work-wg.owner = "anishlakhwara";
+  networking.wg-quick.interfaces = {
+    wg0 = {
+      address = [ "10.0.69.7/24" ];
+      listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+      privateKeyFile = config.age.secrets.work-wg.path;
+      dns = [ "10.0.69.4" ];
+      peers = [
+        # For a client configuration, one peer entry for the server will suffice.
+        {
+          publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
+          allowedIPs = [ "10.0.69.0/24" ];
+          # Set this to the server IP and port.
+          endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
 
   # Auto upgrade nix package and the daemon service.
   services.nix-daemon.enable = true;