diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index d6ccec2..05a56c1 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -19,7 +19,14 @@ in
 
   # Secret Management
   sops = {
-    age.keyFile = "/etc/sops/age/keys.txt";
+    # make sure that the age key is generated from the persisted host key
+    age = {
+      sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
+      keyFile = "/persist/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+
+    # I prefer to use json format for the secrets
     defaultSopsFormat = "json";
 
     secrets = {
diff --git a/nixos/secrets/cloudflare.json b/nixos/secrets/cloudflare.json
index 6ce60d6..01fe7b4 100644
--- a/nixos/secrets/cloudflare.json
+++ b/nixos/secrets/cloudflare.json
@@ -12,8 +12,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSVlXekdnZW02SlpUN0Zq\nS3hzVGtGdkRQRUMrNExqVEFaQnJrVVRNOXhVClJYT2dNVTFuSE9SYnlnSEJmdkUw\nS21pYmRSaFRIVlp5clVST3VTY0YyS1kKLS0tIE9Hd09QWk0xYzBuSzBnU3gzSmFZ\nWUo3T0EyeXUzVjA2SFNFR1QzeW84OUEKObVZ9D7NZPwRXj7OA7EAJtmarT76TnSb\n/SsZ6vU3hQ9Vcn5EIZ39+MpdFluyxZkoq+0di52BHkgExrUD8VD0Lg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-25T02:22:32Z",
-		"mac": "ENC[AES256_GCM,data:70lznJLy9WJ2CBVyx1YO2dl7Npr853960NzC8s306+eZsykpi1CjgfhQGnR6esd7aSOcSmglQ87zqcwAI87AjmYQero83ynunD7HrsD3IxehOuLB+vsv9sPQypPP+OCb2JoJKL9F8IQwFRDq8G0lwDcasXld5i1UfFZTMSWunrA=,iv:rsHaMJbnNphOkDXDaowYR6IzKrJAkB4X5DLvnD+JWhk=,tag:Kkv0lYgMlM8P4nybKbAnWg==,type:str]",
+		"lastmodified": "2025-04-28T04:15:19Z",
+		"mac": "ENC[AES256_GCM,data:sq6OoeaSV/R/ZPTCJFzyVgJvDqkm0f6sxqpbhOW9Q+d6EVbjVsGuLJekEYaCjaWqnFP8yLf1JzxITjQ6hWRJhdp4jWoL5YoUBFMJW3oprZhq95oARq+J7rhJjoAWzfY1h65bMa25WARk5spr++ZyERiJ4hpt7ioiGKqwWB+J2ac=,iv:5mKKH71ciml9EpXGdbLDPHIHMVXD6n3kfAdy27IGMkA=,tag:wx8lImyGN+LPvUZUDm+RlQ==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"