diff --git a/flake.lock b/flake.lock
index 05ac291..5ec9123 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1069,6 +1069,7 @@
         "otter-launcher": "otter-launcher_2",
         "quickshell": "quickshell",
         "sls-steam": "sls-steam",
+        "sops-nix": "sops-nix",
         "woomer": "woomer_2",
         "wrappers": "wrappers_3",
         "wshowkeys": "wshowkeys_2"
@@ -1092,6 +1093,26 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790247521,
+        "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 4408997..800853d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -40,6 +40,12 @@
     };
     wshowkeys.url = "github:DreamMaoMao/wshowkeys";
 
+    # Secrets and stuff
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Flake parts
     flake-parts.url = "github:hercules-ci/flake-parts";
     import-tree.url = "github:vic/import-tree";
diff --git a/modules/features/gotify-desktop/default.nix b/modules/features/gotify-desktop/default.nix
index 22beefb..fb6b37a 100644
--- a/modules/features/gotify-desktop/default.nix
+++ b/modules/features/gotify-desktop/default.nix
@@ -1,5 +1,5 @@
 {
-inputs,
+  inputs,
   moduleWithSystem,
   ...
 }: {
@@ -15,11 +15,10 @@ inputs,
   }: {
     packages = {
       gotify-desktop = let
-        # Requires gpg keyring cert in order to get api key
         config-file = pkgs.writeText "config.toml" ''
           	[gotify]
           	url = "wss://ntfy.voidarc.co.uk:443"
-          		token = { command = "${pkgs.gnupg}/bin/gpg --quiet --batch --decrypt ${./gotify-key.secret}" }
+          		token = { command = "cat /run/secrets/gotify-desktop-key.txt"}
           [notification]
           	min_priority = 1
         '';
diff --git a/modules/features/sops/default.nix b/modules/features/sops/default.nix
new file mode 100644
index 0000000..6b21ef8
--- /dev/null
+++ b/modules/features/sops/default.nix
@@ -0,0 +1,23 @@
+{
+  self,
+  inputs,
+  ...
+}: {
+  flake.nixosModules.sops = {config, ...}: {
+    imports = [inputs.sops-nix.nixosModules.sops];
+
+    sops = {
+      age.keyFile = "/etc/sops/age/keys.txt";
+      defaultSopsFile = ./secrets.yaml;
+
+      secrets = {
+        gotify-desktop-key = {
+          path = "/run/secrets/gotify-desktop-key.txt";
+        };
+      };
+      templates = {
+        "gotify-desktop-key" = config.sops.placeholder.gotify-desktop-key;
+      };
+    };
+  };
+}
diff --git a/modules/features/sops/secrets.yaml b/modules/features/sops/secrets.yaml
new file mode 100644
index 0000000..1273547
--- /dev/null
+++ b/modules/features/sops/secrets.yaml
@@ -0,0 +1,16 @@
+gotify-desktop-key: ENC[AES256_GCM,data:kMCJfkrf5jKAgjX9hT9S,iv:T/zDp94522MeW6V3874JgyaQCx5H1qY+DsZOoPBaC1w=,tag:Csu+9imWiMBYXaE0uXzMsg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKR3ZQTzVxWWFFam91Y1V0
+            VGdnSkZFcmJ6RG1JOHp3R1puY2ZRazkxbmlZCjYyek5QOWEzaWg2bnpXc0ZrNks0
+            QUl2Nk45R1h6WjFTSWlveUF5RHlRcEUKLS0tIE5mYmQ1aWpvNGNjYzJrUW9DSXpm
+            MS8ralY4WDI1YjhNSmRWYWxYL3VkbDAKQuLvaHiUXkwiaOif10vrl3LFh/4mKQUV
+            Y3HJ9Jr3DAyokEzN7S/S1v50coM1bE4d74SS/V1uIw0nYdZRUGrZww==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rg4rsns375z2zj4tv8cyqtjl504fw8tprlmj2w057dz6ztttjstsgjvkvy
+    lastmodified: "2026-09-25T19:37:14Z"
+    mac: ENC[AES256_GCM,data:OMk7qEbx9F/qa6zERu23fNyTzfxbTJZnPyPdVbXhZvjX+KB8pFE1bks6Qfw/C0TwcYsUBIFgr/YO0IaBLStkdoADpeqN4wRbunwTCND0w6V3ZOGza7+5UiT0Zp2KEamuTTco4mDdBUoBkid+aW0jlqAfKtZ4v9VH34IsEOjT2T8=,iv:uqMTZj/rsMFmOWy4aXblmsZ4TVji2i8SfqpCs21VQOU=,tag:x4LtAV6+i8npKygjWjDRpQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
diff --git a/modules/system/desktop/default.nix b/modules/system/desktop/default.nix
index b0dfcee..b1198e0 100644
--- a/modules/system/desktop/default.nix
+++ b/modules/system/desktop/default.nix
@@ -10,7 +10,8 @@
       sddm
       network
       omnisearch
-			tailscale
+      tailscale
+      secrets
     ];
   in {
     imports = modules;