diff --git a/flake.lock b/flake.lock
index 89a7957a..083b346a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1609364598,
+        "narHash": "sha256-dKFCWfUKXRP1z0k/bRMoDOuT0iKM5/starxgG0jn7Ek=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "37b1d2aa3f2afd196350e43b5e90e8bfd8718d90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "emacs-overlay": {
       "locked": {
         "lastModified": 1609865496,
@@ -15,6 +36,21 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1600209923,
+        "narHash": "sha256-zoOWauTliFEjI++esk6Jzk7QO5EKpddWXQm9yQK24iM=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "3cd06d3c1df6879c9e41cb2c33113df10566c760",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -83,6 +119,7 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "emacs-overlay": "emacs-overlay",
         "home-manager": "home-manager",
         "nixos-hardware": "nixos-hardware",
diff --git a/flake.nix b/flake.nix
index 4fdc50b4..5c5f7de0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,6 +18,8 @@
       nixpkgs-unstable.url = "nixpkgs/master";
       home-manager.url = "github:rycee/home-manager/master";
       home-manager.inputs.nixpkgs.follows = "nixpkgs";
+      agenix.url = "github:ryantm/agenix";
+      agenix.inputs.nixpkgs.follows = "nixpkgs";
 
       # Extras
       emacs-overlay.url  = "github:nix-community/emacs-overlay";
diff --git a/modules/agenix.nix b/modules/agenix.nix
new file mode 100644
index 00000000..7aab72c2
--- /dev/null
+++ b/modules/agenix.nix
@@ -0,0 +1,29 @@
+# modules/agenix.nix -- encrypt secrets in nix store
+
+{ options, config, inputs, lib, pkgs, ... }:
+
+with builtins;
+with lib;
+with lib.my;
+let inherit (inputs) agenix;
+    secretsDir = "${dotFilesDir}/hosts/${config.networking.hostName}/secrets";
+    secretsFile = "${secretsDir}/secrets.nix";
+in {
+  imports = [ agenix.nixosModules.age ];
+  environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ];
+
+  age = {
+    secrets =
+      if pathExists secretsFile
+      then mapAttrs' (n: _: nameValuePair (removeSuffix ".age" n) {
+        file = "${secretsDir}/${n}";
+        owner = mkDefault config.user.name;
+      }) (import secretsFile)
+      else {};
+    sshKeyPaths =
+      options.age.sshKeyPaths.default ++ (filter pathExists [
+        "${config.user.home}/.ssh/id_ed25519"
+        "${config.user.home}/.ssh/id_rsa"
+      ]);
+  };
+}