diff --git a/.config/gotify-desktop/config.toml b/.config/gotify-desktop/config.toml
index c002779f..ddd5a5a6 100644
--- a/.config/gotify-desktop/config.toml
+++ b/.config/gotify-desktop/config.toml
@@ -3,7 +3,7 @@
 url = "wss://ntfy.voidarc.co.uk:443"
 
 # secret gotify token
-token = "C5YKvW5h3NfJJIB"
+token = { command = "cat /home/user01/.dotfiles/.secret-gotify"}
 # if you want to get the token from a password manager, or other external command,
 # you can also use for example:
 # token = { command = "secret-tool lookup Title 'Gotify token'" }
diff --git a/.gitignore b/.gitignore
index 1f8011aa..6e4b9ec3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
 .session
+.gitsecret/keys/random_seed
+!*.secret
+.secret-gotify
diff --git a/.gitsecret/keys/pubring.kbx b/.gitsecret/keys/pubring.kbx
new file mode 100644
index 00000000..f28bf7d4
Binary files /dev/null and b/.gitsecret/keys/pubring.kbx differ
diff --git a/.gitsecret/keys/pubring.kbx~ b/.gitsecret/keys/pubring.kbx~
new file mode 100644
index 00000000..525e23fb
Binary files /dev/null and b/.gitsecret/keys/pubring.kbx~ differ
diff --git a/.gitsecret/keys/trustdb.gpg b/.gitsecret/keys/trustdb.gpg
new file mode 100644
index 00000000..0abf1300
Binary files /dev/null and b/.gitsecret/keys/trustdb.gpg differ
diff --git a/.gitsecret/paths/mapping.cfg b/.gitsecret/paths/mapping.cfg
new file mode 100644
index 00000000..00b71037
--- /dev/null
+++ b/.gitsecret/paths/mapping.cfg
@@ -0,0 +1 @@
+.secret-gotify:f6129ad401b60d5a491d582169088600bb58a537d232b93c22923aede129d5cc
diff --git a/.nixos b/.nixos
index f0855529..90c612bb 160000
--- a/.nixos
+++ b/.nixos
@@ -1 +1 @@
-Subproject commit f08555296caa407b4de1d9f87ee6af6eac0fcbef
+Subproject commit 90c612bb57f1486dcf4afd9541bc4689c82d1478
diff --git a/.secret-gotify.secret b/.secret-gotify.secret
new file mode 100644
index 00000000..2db103fd
--- /dev/null
+++ b/.secret-gotify.secret
@@ -0,0 +1,2 @@
+�^������j
@:p�X�a=�m�A��9�
Q��t$)C�~�'s0�f�JA@:I�
���o��_�z>�*�����C�kߋ�))=�eBx�Y
�O�
+R�fM�n�1�Ys�Y�c�a|o\���&:x��Ngu����q)�e�t�1RO���VՔu��=�}㺴{�YM6Fʟٮj&�
\ No newline at end of file
diff --git a/doot/config.toml b/doot/config.toml
index 33ce4606..49f78a14 100644
--- a/doot/config.toml
+++ b/doot/config.toml
@@ -11,6 +11,10 @@ exclude_files = [
 	".gitignore",
 	".session",
 	".gitmodules",
+	".gitsecret",
+	"*.secret",
+	"**/.devenv",
+	".secret*"
 ]
 
 # Files and directories that are always symlinked, overriding `exclude_files`. Each entry is a glob pattern relative to the dotfiles directory.