diff --git a/flake.lock b/flake.lock
index 891aee0..0b62f80 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,25 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1664140963,
+        "narHash": "sha256-pFxDtOLduRFlol0Y4ShE+soRQX4kbhaCNBtDOvx7ykw=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "6acb1fe5f8597d5ce63fc82bc7fcac7774b1cdf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "bonfire": {
       "inputs": {
         "flake-utils": "flake-utils",
@@ -8,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1664356228,
-        "narHash": "sha256-YLmsR/OSf7q0t3/7gAPI0Uf9sS9JQSWF7trmrtsDPOo=",
+        "lastModified": 1664777933,
+        "narHash": "sha256-+ngnfFpWnsJeSPoTDLe8+hsMBQ4nFzJDOyNa/XNxzvY=",
         "owner": "bonfire-networks",
         "repo": "bonfire-app",
-        "rev": "9533e672724198fcad61ba4d7f7e92649cb4a655",
+        "rev": "8607eccc8b6d6a311095c35e764e35905ae6883e",
         "type": "github"
       },
       "original": {
@@ -69,6 +89,7 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "bonfire": "bonfire",
         "hardware": "hardware",
         "nixpkgs": "nixpkgs"
diff --git a/flake.nix b/flake.nix
index 7480813..00d5c4d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,10 +7,11 @@
     hardware.url = "github:nixos/nixos-hardware";
     bonfire.url = "github:bonfire-networks/bonfire-app";
     bonfire.inputs.nixpkgs.follows = "nixpkgs";
-
+    agenix.url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { nixpkgs, bonfire, ... }@inputs:
+  outputs = { nixpkgs, bonfire, agenix, ... }@inputs:
     let
       forAllSystems = nixpkgs.lib.genAttrs [
         "aarch64-linux"
@@ -33,7 +34,7 @@
       # Devshell for bootstrapping
       # Acessible through 'nix develop' or 'nix-shell' (legacy)
       devShells = forAllSystems (system: {
-        default = legacyPackages.${system}.callPackage ./shell.nix { };
+        default = legacyPackages.${system}.callPackage ./shell.nix { agenix = agenix; };
       });
 
       # This instantiates nixpkgs for each system listed above
@@ -61,6 +62,7 @@
             # > Our main nixos configuration file <
             ./nixos/configuration.nix
             bonfire.nixosModules.bonfire
+            agenix.nixosModule.age
           ];
         };
         test = nixpkgs.lib.nixosSystem {
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..7ebb077
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,6 @@
+# let
+#   system = "";
+# in
+{
+  #   "bookstack-app-file-key.age".publicKeys = [ system ];
+}
diff --git a/shell.nix b/shell.nix
index 9662b11..cb3de08 100644
--- a/shell.nix
+++ b/shell.nix
@@ -10,9 +10,10 @@
     overlays = [ ]; # Explicit blank overlay to avoid interference
   in
   import nixpkgs { inherit system overlays; }
+, agenix
 , ...
 }: pkgs.mkShell {
   # Enable experimental features without having to specify the argument
   NIX_CONFIG = "experimental-features = nix-command flakes";
-  nativeBuildInputs = with pkgs; [ nix home-manager git ];
+  nativeBuildInputs = with pkgs; [ nix home-manager git ] ++ agenix.defaultPackage.x86_64-linux;
 }