diff --git a/system/modules/sops/secrets.yaml b/system/modules/sops/secrets.yaml
new file mode 100644
index 00000000..6d83b736
--- /dev/null
+++ b/system/modules/sops/secrets.yaml
@@ -0,0 +1,24 @@
+kopia:
+    server-password: ENC[AES256_GCM,data:D2yE4j4=,iv:j96uk5MuHrrEf8y6c3HWBB822fBjC5ilhO6GMnruU6o=,tag:YmqD3Id7jD4sPAu2ncFJaQ==,type:str]
+    user-password: ENC[AES256_GCM,data:Trv39FNFSzvb2g==,iv:Bqvv8UipTIWd7zkYCZNe8Wjj+zdt2b8J+86g2gRKfvY=,tag:Jb6E76hj1bkSmqxPu6c+mA==,type:str]
+dockerhub:
+    password: ENC[AES256_GCM,data:7q6WsQ2rVIAC7HeLqYUK1g9WmTAEu8vvplpe/Kmt7Ns=,iv:x3b3eoj3UuRK3XZAN6KyYcVlXjm7sidtoqaByPdl90s=,tag:vZKO5gxtFG5nSiRQxxfCGQ==,type:str]
+heidi:
+    discord-token: ENC[AES256_GCM,data:lhG/5UHsgJX6dF8x29GlPJ0SL3WVRd72NgiTAIqJOGODlzDqjqRG+vM+FR2Rn2QPt9MatqDWH4c9hxQ=,iv:hd2DFftCaPnDO74n0SKsOEstRoUdgRshUPliFhtjSEc=,tag:nJs/PYDj4f7g4gdiEGrStQ==,type:str]
+sops:
+    lastmodified: "2025-07-09T14:23:23Z"
+    mac: ENC[AES256_GCM,data:Q7TiCljoWvzTsfmHc3xjh2rc4KKtw4rhxm0IkeZlUv0lshgjfrNpLxZVDnACavWG8ez379vpauuIhwZdZIaoO8Vtd2RfCS6bIOr4LdO8c89fVMhKSWa00a1uKsjjKTra9uAWoZZjBcZjLzAeIJWEHfcjQqqDNZl9thMAlguIr+Y=,iv:w41vmyiBrkzPzCZKzkAEF7jVyhOOTCgoEkAxYYa+VZc=,tag:Qw/asLEK/dms9GD+rJp4aA==,type:str]
+    pgp:
+        - created_at: "2025-07-09T14:12:43Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DqfTzg9CqtWESAQdAu4+RjWQkFhZACL8agIDAfDRl7SGwkerlYB/JVwbTvF4w
+            Aka16C3y25sjOegyLfuHm0omD1ojca9LgfEDPIh3sUTlUcMttPDYbmraW6MDMM/W
+            0lwB+1YoPkhaT0AhwmFG+1PnVGtCaOaV3yaBsEv6KBrQ6D9PkgAgN1sNmVgRevXo
+            pMjdAsFTRXeJyCAtvAwYet0IhhZ5NqMvvkmjU5Mo3eV/eil4w8WafYq4qOamfw==
+            =Cs9+
+            -----END PGP MESSAGE-----
+          fp: 2D77520CF698928A855E0B9A2AB59FDA7728388B
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2
diff --git a/system/modules/sops/sops.yaml b/system/modules/sops/sops.yaml
index aa9be99f..1bf37b8f 100644
--- a/system/modules/sops/sops.yaml
+++ b/system/modules/sops/sops.yaml
@@ -1,4 +1,5 @@
 keys:
+  # sops-nix public gpg key fingerprint
   - &christoph 2D77520CF698928A855E0B9A2AB59FDA7728388B
 creation_rules:
   - path_regex: secrets.yaml$