diff --git a/homelab-services/incus-vm/.sops.yaml b/homelab-services/incus-vm/.sops.yaml
new file mode 100644
index 0000000..ebf052f
--- /dev/null
+++ b/homelab-services/incus-vm/.sops.yaml
@@ -0,0 +1,14 @@
+keys:
+  hosts:
+    - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+    - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+    - &nixos-homelab-00 age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+    - &nixos-homelab-00-user age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *laptop
+          - *desktop
+          - *nixos-homelab-00
+          - *nixos-homelab-00-user
diff --git a/homelab-services/incus-vm/secrets/ex-psql.yaml b/homelab-services/incus-vm/secrets/ex-psql.yaml
deleted file mode 100644
index 5e0f293..0000000
--- a/homelab-services/incus-vm/secrets/ex-psql.yaml
+++ /dev/null
@@ -1 +0,0 @@
-PSQL_TEST_PASSWORD=password1234
diff --git a/homelab-services/incus-vm/secrets/psql-example.yaml b/homelab-services/incus-vm/secrets/psql-example.yaml
new file mode 100644
index 0000000..d90a777
--- /dev/null
+++ b/homelab-services/incus-vm/secrets/psql-example.yaml
@@ -0,0 +1,43 @@
+credentials: ENC[AES256_GCM,data:ZExq00BrgRqkouu/hTee5LLsAW8JKqSrAI25vJqkCQ==,iv:JWbVLagZGsYPJh3GiWKAveHt8+eagRP8Uw1/l5f61T0=,tag:70GZuRPn04Y4TKNA2YSJmQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VXJMdFVwRjJwV0daRXNx
+            TE9DUjZkMjJuRHFIZlVwQWsrWGUzZjFBL2w4Cm9QbExCZWVRUnFzVnozMVY2Mlpi
+            U29kNHlZKy80dStBdE1NM2N1cU1rUUEKLS0tIG9iQjVzTENpNlgyRlRTN2ZLclFL
+            MU5WSXptcFREeUJtTVp3ZlcxbUpwTkkKS74kwnEOt8wR8ZxvKgj57B5tzbKED5vA
+            1HWGRRj26PoBDMMKBB2/2qqTEz+hWij9UMxmMTmPe8+5+mhBSN503w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaHNVSEVUSGFONXJya1l0
+            eWh2VzdNNVBrV0dqK2dGZXBTcXd4RXhDUDJjCk9nUE5mS1N0UjdnNWRkTjBHcXdO
+            aWsvNTlBUWJuUU9nL3ptZXBvOGkxcFUKLS0tIHE4ekpzQ2MzK1J3UkFpREhvdUFR
+            Q3hLVXZ3V2hwcWxUdnYyRlhqQTJORE0KBR7OTJ4fE/iudHzgstSPYp5OZYr0GWBf
+            VoLPZ6yNEvW36BmNSuazPq8B9VsOW6PwM315OaROqvfNIL2FaEk3aQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNWU5RGtiMkFlYUF6cUpV
+            YUs2dE9kRXlFbWk3Q29FTGR0bXVzZ3p1eTFJClhXUjBYY25WY2JMQzBJTDA1dFlP
+            UURGZVp4aUZTeHF5bDRjQVU1YVhXYkkKLS0tIDJ3R2tqckJiSEJzN3ozS3QxbDl4
+            dXA5Z2plZzFHM2UvSmg1U21POWkrWmMKeGe3AkWyYQmzclt1ehdgoi3v6fH1+E4a
+            NfZDpl6ksb19ddAvqC0SnWk5NQ+SSVpelZVvqZ/J5/37YEAZHPphaA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZXJ4dFQzVGhNT1RHU2pH
+            ZFNVRm02MzRRcG9yanQxdWFIcHV5QlZBNUI4CjVBS1NDWjk0dGtDODB1M2wyMzVB
+            QTB5UVRnTnBuWGlZdnQyc0pyQk5iakUKLS0tIDloTkJSMVJabWZvbXJFd25RRjR0
+            QWpicXdFUXM0RXhXZ3hsb0o2STVUMHMKkVxR+AWnWuWlohZ5+z4aNoptJ5K3mnGG
+            EfoqN0Y2AeSA8IQKlT3wrYGsulolj940NsDBQREEz8jk1sh3S4bImQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    lastmodified: "2026-09-18T02:12:50Z"
+    mac: ENC[AES256_GCM,data:6XRcEc2D8IabmjAbOpP4UgB4O3y1eWSUAXk+T7Lz3+4fQr6MwnW45IqS3OmdeETWflmPu87d6k7mOtoyYuRoosjzdo4E5f4ujq/3794IHf3oa0FDEepgTadc+Uu8PYCEbEOIK29PdKZg4o69eOzIM62H24NStLTWOI2mp2waIAc=,iv:B2zT2AgDdG3txqU64/PjF/kvfUl+eHtEYaoOtSglS40=,tag:HtgISbKNjzrsBb75fbJAnQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3