diff --git a/virtual-machines/.sops.yaml b/virtual-machines/.sops.yaml
index 01a9045..c294d83 100644
--- a/virtual-machines/.sops.yaml
+++ b/virtual-machines/.sops.yaml
@@ -2,13 +2,11 @@ keys:
   hosts:
     - &laptop age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
     - &desktop age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-    - &nixos-homelab-00 age1h0rmmv9lwql34a73e07e9ms6et4np8puqpmrpk6yh75h4q994ydqqs7fs4
-    - &nixos-homelab-00-user age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    - &virtual age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
 creation_rules:
   - path_regex: '.*/secrets/[^/]+\.(yaml|json|env|ini)$'
     key_groups:
       - age:
           - *laptop
           - *desktop
-          - *nixos-homelab-00
-          - *nixos-homelab-00-user
+          - *virtual
diff --git a/virtual-machines/vm-test/flake.nix b/virtual-machines/vm-test/flake.nix
index 34deb12..03d8455 100644
--- a/virtual-machines/vm-test/flake.nix
+++ b/virtual-machines/vm-test/flake.nix
@@ -26,7 +26,8 @@
           value =
             pkgs.runCommand "sops-decrypt-${filename}"
               {
-                SOPS_AGE_KEY_FILE = "~/.config/sops/age/keys.txt";
+                # Use special separate injectable key that can only decrypt these dummy secrets
+                SOPS_AGE_KEY_FILE = "~/.config/sops/age/virtual-key.txt";
               }
               ''
                 ${pkgs.sops}/bin/sops -d ${./secrets}/${filename} > $out
diff --git a/virtual-machines/vm-test/secrets/plain.env b/virtual-machines/vm-test/secrets/plain.env
deleted file mode 100644
index 5e0f293..0000000
--- a/virtual-machines/vm-test/secrets/plain.env
+++ /dev/null
@@ -1 +0,0 @@
-PSQL_TEST_PASSWORD=password1234
diff --git a/virtual-machines/vm-test/secrets/psql.env b/virtual-machines/vm-test/secrets/psql.env
index 7f8a5bc..1da8aa9 100644
--- a/virtual-machines/vm-test/secrets/psql.env
+++ b/virtual-machines/vm-test/secrets/psql.env
@@ -1,12 +1,10 @@
 PSQL_TEST_PASSWORD=ENC[AES256_GCM,data:23yfH/WahP629zM=,iv:d7MCyz1OD/Ns1D4KMMtOhMMnG3WVXG406sUA5Xv0eFw=,tag:QTa5Akrd/co03MZn5C2VPA==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnSjVXUGdtUjZBbCsxdXJn\nWmk0aENaQUFSemxOSnQ3SzNIbGtvMTNFTzNVCkJPcXFCOXdUbEN3cUtOei9SSTB5\nNUdkK0wxcGFYT1ZUZmhrVUMwbE1WV0UKLS0tIHJlSmE3TzBDQkgrc2tFOXVYcVIz\nM1BiMHJ0dHJBYWc0Yk81dlp6VW5xQWsKqZqHYlzmTrncbz2bYdL+tJpTcZI9FJiQ\njzcKThgvpsoj8iOzx3zEW5K3fbTeQLBKAUGZ4CjJdZbI54jrNo61CA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBROGx3UzlSZUhUZ25aOVdG\nZUZhWWg3NTRsT0hvSEUrSWQyb2hUOGpyaW44Cks0bUdhOEI3Mmp1eFRUTVhWQ05R\nYWFjRXRXQVJvQWw3VzFEWm52WG5XZGsKLS0tIFdpbFovSEorWGRjZjB0MVpMb2VJ\nZmFhNy82cXNXY0hiSDhnNXo2WWFGcFUKrX8854hXdiJ9vFwfEL8Q2rLUd+Bdk04V\nNkG88VYBZh1B0bJz/Ezs6X18+crbzF58vkdf7YVBGJbjjLSHVc6e0A==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWDFNMjJuQkZwUW94UThH\nT1ZXNVQ4WHVWOTBxWjZWWkhaWEw3SDlHVDBjCm4veWxyNld3UWJGSHllZVZpZTlv\nN2RvNlkzODdtTUNKb2xzSFpJeW1JMDAKLS0tIFZJYm1zaktDWnBZL05iQW95OGFi\naHZFSitUQ0Q5LzJKQldob25vdkpDM0kKYuRWZRjdkpDDhvEb2LsZqDat7Z1Wfqit\nUxpLbaQWyZQfpD8xAF+BuxduJ68mzR3mJwuiBEDHKWi2cxCJ8WAsKw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Mm9ScFFJamlmUG1wWWxt\na09FU1crRUk1Z1YwZDVVZFR1Vjc4cUowYTA0CjZtN3lNQUw1YW91a0I2aGtjK3hy\nNW5mbnZRTVJHR0ljcmcySDhtM0tKSnMKLS0tIEl5Q2JQWHpDTEQ2bTJ6a29mY1BZ\nakFYaFFVdUlYOGdzTDFKYzNSdUtvY3MKVjqG0iWlGEEDNWkzShrUs09DpyGO6LiD\nkOwCJ7pCr2RvJzwh/OYC70CmdXMS5D2vzhtojDwrDLxeLG0EDqFitQ==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVVmpQVHEvSS93bzZWQ2Ri\nQk9sZHJRd2pzL1B5S3p1MGRIUnZiamhUVVVNClgwZ2xHK0JGOFRUblBWRC9vUTRR\nNFFuSDFrR2J1SWcraXN5S0JIdGt3NlUKLS0tIE01NEY2UVRUc0dLU1c1bTdHa3Vt\nOGpFK1hPWEY0SUk1MEhXTUVOUDdFYmcKcS32XX8swLMP/0i5l9I/eSkeaGfM6KTd\nAZ5eIp75bQl9/FHoSmMpKtl255Iq2kXJH2dP/ZH7s4vdcV50f42VOw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_2__map_recipient=age1h0rmmv9lwql34a73e07e9ms6et4np8puqpmrpk6yh75h4q994ydqqs7fs4
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpM3ljT09XTDZlNmUxZUpU\na2pwK0xvQW84U1J4VFloYzh3RHdheVNGUXg0Cm1qMjA0SlBEUkhVUWt6a3pQZHBS\nNnRpNE93ZnhhSXNrbWFEekJQVG5JSDAKLS0tIEl1WlpqVSs3QlM2UFJvYjVwdzN1\nQVN0aFRHei9DelFBclR6WnBKZEFHcncKtcL/DCWBAspfuSNKNGjmLiT1IYqaCZdC\nSQYViXRSLFyBdRbXnFrOP9ZKzPSTiILGyot6+TofTi63jFIxbxx/mw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_3__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwc29mdVpIdm15cmhkTEJ0\nbGFpbGtXaTU4amh5MWxwSE9aanRkQVFmN1Q0ClQ4ZlRUa1R3R1NxS2ZGR3NXVVJn\nMEVESGV1V3VXeWpLbnBmK2JRdTlob0EKLS0tIGQrYmw4VlJKUzYxcytOUVRjTGhj\nTEM5NGNycFNJbzdBMnVUWVN0OGZMNG8KQa4P4gss/iDfR0neSczhIzbZOloMh6aY\n08qGUdi3pkioyed6fyzDUk9NvEWUdGMBPVT0PvY71zEpFYeWr6GYNg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1q5zwds8g47j7xsqhp8tk995l3n4a5z876vff7wgx4sztwgdsa3yq7eu6xk
 sops_lastmodified=2026-09-26T06:04:51Z
 sops_mac=ENC[AES256_GCM,data:Q4AhgLZLR6hSSiwextwm53DHKKeSN+YSLKyQGNfZG/sb/c+4QOQxYXZD2YXShbOei1Og+IqcVCkJy+CaYAE6roz04AxnQgis3anVOSOAMAcezFndXU/f80pqkikj/o14O6ueOi/2gQMJND9HHEZSJBAwpJbsX1CLru16Uv2gkaY=,iv:nItKXHq2sgw8ijA5d/DxeTAafkwIUuxJXyXOP8gDuL0=,tag:oNYfflLLKhhQN8H1DRBVUQ==,type:str]
 sops_unencrypted_suffix=_unencrypted
diff --git a/virtual-machines/vm-test/virtual.nix b/virtual-machines/vm-test/virtual.nix
index 4d067d1..94e7915 100644
--- a/virtual-machines/vm-test/virtual.nix
+++ b/virtual-machines/vm-test/virtual.nix
@@ -72,7 +72,7 @@
     enable = true;
     dataDir = "/var/lib/postgresql";
     port = 5432;
-    credentialsFile = ./secrets/plain.env;
+    credentialsFile = credentials.psql-env;
     databases = [
       "test"
     ];