diff --git a/.sops.yaml b/.sops.yaml
index c62ba58..2b4aaa1 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -195,3 +195,19 @@ creation_rules:
           - *lxc-minimal
           - *proxmox-minimal
           - *linode-minimal
+
+  # Host keytab for ha-server-1 FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/ha-server-1\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          # proxmox-ha-server-1 added by sync-host-keys.sh
+
+  # Host keytab for ha-server-2 FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/ha-server-2\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          # proxmox-ha-server-2 added by sync-host-keys.sh
diff --git a/secrets/ha-server-1.keytab b/secrets/ha-server-1.keytab
new file mode 100644
index 0000000..ca4b2f8
--- /dev/null
+++ b/secrets/ha-server-1.keytab
@@ -0,0 +1 @@
+STUB: not yet enrolled — run: bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.228 ha-server-1
diff --git a/secrets/ha-server-2.keytab b/secrets/ha-server-2.keytab
new file mode 100644
index 0000000..964c357
--- /dev/null
+++ b/secrets/ha-server-2.keytab
@@ -0,0 +1 @@
+STUB: not yet enrolled — run: bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.227 ha-server-2