diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..f0bd4f3
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+secrets.nix filter=git-crypt diff=git-crypt
diff --git a/flake.nix b/flake.nix
index ffcce7b..e3d1f25 100644
--- a/flake.nix
+++ b/flake.nix
@@ -34,7 +34,7 @@
     lanzaboote,
     nixvim,
   } @ inputs: let
-    secrets = import ./secrets-legacy.nix;
+    secrets = import ./secrets.nix;
   in {
     formatter."x86_64-linux" = nixpkgs.legacyPackages."x86_64-linux".alejandra;
     nixosConfigurations = {
diff --git a/secrets-legacy.nix b/secrets-legacy.nix
deleted file mode 100644
index 042a4f5..0000000
--- a/secrets-legacy.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  aria2_config = {
-    rpc_secret = "<rpc secret for aria2>";
-  };
-  frp_config = {
-    ip = "<ip addess of server running frps>";
-    token = "<secret token for frps <-> frpc connection>";
-  };
-  caddy_config = {
-    email = "<email for certificate generation>";
-  };
-  users = {
-    root.hashedPassword = "<password hash of root user>";
-    primary = {
-      userName = "<primary non-root username>";
-      realName = "<primary user's full name>";
-      hashedPassword = "<password hash of primary user>";
-      pgpFingerprint = "<primary user's pgp fingerprint>";
-      emailAddress = "<primary user's email>";
-      sshPublicKey = "<ssh public key>";
-    };
-  };
-}
diff --git a/secrets.nix b/secrets.nix
new file mode 100644
index 0000000..7bec92e
Binary files /dev/null and b/secrets.nix differ