diff --git a/.sops.yaml b/.sops.yaml
index 98b3b19..8178b4a 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,6 +4,7 @@ keys:
   - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
   - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
   - &lxc-minimal age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
+  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
 
 creation_rules:
   # Shared across every currently-deployed host: root/nixos password hash,
@@ -18,6 +19,7 @@ creation_rules:
           - *server
           - *nix-cache
           - *lxc-minimal
+          - *nix-minimal
 
   - path_regex: secrets/nix-cache\.yaml$
     key_groups:
diff --git a/secrets/common.yaml b/secrets/common.yaml
index c32a6f4..4d6d478 100644
--- a/secrets/common.yaml
+++ b/secrets/common.yaml
@@ -5,49 +5,58 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHS3Fkd2JMVDk5NHJSTVhG
-            QUxtQy9qVTdITVU4Z0N5Ty9WMnZYZjU0UXdrCnVLTWhCWmNyOHhYMi9mSFpPK3ls
-            YldJTWcxK2dNL3RpSnlRZFlwTHV6bVUKLS0tIGhjK25JNlRMSkJhV1o1a1JNN29J
-            NjViQldhSUZXTmJjYjhqdTdhY1I2YjQKYTTPfc5qx6Sxc1yuvol6JmkkJEM3pELk
-            gPgW5dfS34CKhCt2GWwEdIpOcMNEqL1+0iXboR/cjSGeUK7PP8iwOw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1SlRDcThHRmlqVEh3aStW
+            ZmhFSXV6bGI2akI5QXlmTm02d3JNNGdoL1VzClRFMG0vb3VBay9LNElIZHR2a3FJ
+            WUFHUWl6cjk4MzNJaFFYa1psTXByTWsKLS0tIFJvS2x0RkxjZG9IMEw1emNSVEI1
+            STd5NFdKTERlOHpiTktQWFFhcmRJQ2MKf6f371rHxkWjQwSGxMa09Q0j/6Hjo5je
+            1RQMVpHJsYIMwGrPW74KYHJUHZiS8OF9mU/+Cum07jsQugg042SCQQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2M2ErTkRNSTJ0OHlLSXJ4
-            S3haYVN4VXd5TE5RRkpMcEU3TkFYNDFUV2s0ClJ1ekMxcUJ0eFhtcytpQU1xcFAr
-            MjBwWVdlMnpnYm5peDUwU0NJMEh1S1UKLS0tIHZZOHZQYWlHZy9xVVdrNTBaWDFX
-            Mkd6a3JYMCtDT3ZSZU1MNWVlQkszbm8KIKVVNVCkptOMZ99sqpEqB52hCEAb79xA
-            pQtGpNtXgP3v/dkGlAAgXShcf/w+owzr62NuPCzZZ5yJzKUC+E8F1A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aTlpVk5ENjJ5alZCU3dG
+            d0dEV0FCcUFHOVJHMWtSQ25WWWtvS0FxSnhjCjNOZGhWUHNwRUxJemlrYzIzeFJM
+            U2ZrZ1l6bDhtZlF2WWwrZGNJT1dXblkKLS0tIG5CemxQb2Y2MVhVUHg5UkpZNTNE
+            ZktLQWQ5TWRjSWpmZlE5cXZObHBoZnMKJeUaSafIOZcZSeSagg6QqPbWnzDfQmo1
+            Kbm6TvcK9HC3pvWTLKx1wp81Z2ez60Grsu9XM/v5otTntHyUpVuegQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTFZ1T0ZlVTZBN3dVbVNL
-            bUxZMEMxZU9sUVdZZzMycklWa2UxY2ZnekE0CnI4dWxta09NdHNvRTlGRjYrSlcx
-            bG12ZFlZc04vWnpBcjhxV3ZwNjlRQncKLS0tIFZiY0VYVkVuYk9LemxtL244bks5
-            VXFVajFYbXNHYlYvMTlQc1NNaFFaRDAKOk70/HMHUpN4VOpRVzOVwWeZVWBibvTb
-            AOqERqk/ml/uEmRQ31T0mx8+GAYkWxcMgVZP6236rFx4GgmMB1+soQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoM2g4Z3Q2alV1eTJMeGUv
+            Zm5qQ21OZzBBbTBKMjEyejd5ZWc5aU9XQlFrCmpoOVM0SWd0R2h0QTVudmd5Ulp2
+            ZHZHRGdFZXI4RnV4ZTUxR1RqNEY3Q3cKLS0tIEFPSWFUU0N2NzRhQjdoandqL0Vu
+            YnZXUmRJd1BZbG52UHZNM2ozQ0Fqb1UKWIPK88PpKb87KTM8ft+zF3gtS/XSzMET
+            qxerwjtXFCZMn7bbTq3N692XbN3dWJjzDoufVTVI+RKFPN1mJEgC/g==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFb2liZEs4b2NKdVAxVkJ2
-            Ty8rQkVWRWdKKytUSCtSVllLc1BYbldtc2hnCjNpYWVmUnFLV0FNM2tqVlJiN0Jt
-            NTY2YXhBSWNIcnM2VTNmUnBVZlcrSzQKLS0tIDdNemplMzZjZms2WDUveVFTNDRu
-            OTRwejhjak9RMmJTdkFtRlBOQ2xsdUkKV55k3mp7xxyt2iYNsnoyR/4RAvv2Gvl6
-            wSdduUF0EcmOTaxJ1VWva85dbBWslXo0L8ropCcEiXgVy+xwh7VLzw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1VGJudWJpOXdpdXc1cFNB
+            cUVkeFhSbjIxbnJwZVJwSDlRRzZHWDNaOTJBCmd3cmlqcW00T01FOHZFdnpUQUEr
+            Zk1JRmlZblUranJSZGRSNDNNL29JSFkKLS0tIEZEOTFseUp2c21kMElnYno0QWVV
+            MHE2RDZDdmMycWxjYnh6cEUvcjlJOTgKGNoaBpu7wKKJlUUPNmZvsvs0X1M/Y1GT
+            Mc9raII1Bi7lzdBnH3ELE4a4wb9RSxsR7jSG/r81q/8Fc7Ayby6TYg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqYlRoOFRKK3BrR2EraXdq
-            b1lpVnIwUkRxUlhwcldkL2JRWDM2TzVNZHpzCmoybE5PYmNUUlVETFVaKzBoNVZo
-            RkY2dTNEdzU0QTBpWThhRGF1MURNdVUKLS0tIGdoYmlWaHA2Ykxla0JGRXlhaU1V
-            Vm14emg2b2dJeTViWS9pYzFObGYwQ1EKGI6jTgR8zSPzsB2CJ2s+EAEFSNhYe8Iv
-            dHtJTJQYRKx7Uq5j5EesV/uf3DKi9fa12nwzX1uINCTkJF/DHKrM2w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBodVJQK1dhS1VGMllKS0xQ
+            U1dadWJ6ZjFKTUcyZTJiMDJHaGMyd2Y3NXdNCllHa056OXgzZ1kra1lqaHU1dVhT
+            T095ZVR5WUJzblNuQ2FLMVYyaDU1QzgKLS0tIG5ROHZUK0NITHVFeDhUU25qVXgr
+            dnlCQXJ2Q1JiSERBQ1VrT1hRcnRkbHcK9ICUpxQCUcsfGKYyLIMdRezWB7xgOH+1
+            kVqLK2quXlaNcT3V/A4eHnQ00YQz3ksowjpUs5vtOEtkCfzmUm0uMg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTWxNV1lqNXJqNWEyeGFq
+            QW1mNTB4SHExVU5ZOUZ0M2k1Y3FYNGNWbEYwCjl5aHlseG1QdnNnWkpYZjl0cXo1
+            NFZVc21PQmZNZllMcnJxT3UxRW53V0UKLS0tIG9SeFkvQS9HcUxEREdCN1R0L3Rt
+            TDRLSkcyeEg3SWJLL2R0MUVuUFN4RHcKxU1JXzofo3DfosZCYFvs8o2+ZHqrUEfl
+            3cwb+Rf71EMbZX3j9ZwzZxcz6z0Q8FS3vdfL10t33cwF46CTBzawCw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
     lastmodified: "2026-07-19T02:30:40Z"
     mac: ENC[AES256_GCM,data:UiL3VMDF6rq4Nr87KspcDx434q3tfNXeb5pwH2O+4ssNQ6xzcYDdzXBnhAY3zLBsqPMKrvHBd4Ot/gEMcq3FMIVe7Q6p9yWKpep66KZ/yWEhAlwIVhD79Oj8VS+1CHKjf25zpRdhZorp04oeFQQd9VfjJB4EE/Q1aVbwTGlpIic=,iv:i/0conaFgFia+wzNTdUL6tlSTw35HTK3Ap1Sr5RGHf8=,tag:ULbz5FllShA/JjlSRdxA0g==,type:str]
     unencrypted_suffix: _unencrypted