diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..d6a3241
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,11 @@
+keys:
+  - &pazuzu_local age15y4k929zaj9fdg3vd40pa40tgvrgv9mn22xfummn5zxfmkcw5d0st6prjx
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *pazuzu_local
+  - path_regex: host/pazuzu/secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *pazuzu_local