diff --git a/machines/jupiter/environments.nix b/machines/jupiter/environments.nix
index e36c825..f0f4850 100644
--- a/machines/jupiter/environments.nix
+++ b/machines/jupiter/environments.nix
@@ -1,9 +1,5 @@
 # enabled profiles
-{ config, lib, ... }:
-let
-  secrets = config.sops.secrets;
-in
-{
+_: {
   my.profiles = {
     hyprland.enable = false;
     zsh.enable = true;
diff --git a/machines/mibook/configuration.nix b/machines/mibook/configuration.nix
index e326ff7..dd86852 100644
--- a/machines/mibook/configuration.nix
+++ b/machines/mibook/configuration.nix
@@ -11,6 +11,7 @@
     ./hardware-configuration.nix
     ./environments.nix
     ./network.nix
+    ./secrets.nix
     # ./system.nix use docker here
   ];
 
@@ -21,7 +22,6 @@
     useOSProber = true;
   };
 
-
   # Configure keymap in X11
   services.xserver.xkb = {
     layout = "de";
@@ -35,7 +35,6 @@
   services.printing.enable = true;
   nixpkgs.config.allowUnfree = true;
 
-
   hardware.nvidia.prime = {
     sync.enable = false;
 
diff --git a/machines/mibook/environments.nix b/machines/mibook/environments.nix
index 8581e93..286209b 100644
--- a/machines/mibook/environments.nix
+++ b/machines/mibook/environments.nix
@@ -1,9 +1,5 @@
 # enabled profiles
-{ config, lib, ... }:
-let
-  secrets = config.sops.secrets;
-in
-{
+_: {
   my.profiles = {
     kde-desktop.enable = true;
     zsh.enable = true;
diff --git a/machines/mibook/secrets.nix b/machines/mibook/secrets.nix
new file mode 100644
index 0000000..9678642
--- /dev/null
+++ b/machines/mibook/secrets.nix
@@ -0,0 +1,12 @@
+# Secrets decrypted on mibook. sopsFile defaults to secrets/mibook.yaml
+# via machines/core/sops.nix.
+{ ... }:
+{
+  # Pipeline smoke test — proves host-key decryption works end to end.
+  # Safe to delete once a real secret is in place.
+  sops.secrets.placeholder = {
+    mode = "0400";
+    owner = "root";
+    group = "root";
+  };
+}
diff --git a/secrets/mibook.yaml b/secrets/mibook.yaml
new file mode 100644
index 0000000..44a9b20
--- /dev/null
+++ b/secrets/mibook.yaml
@@ -0,0 +1,25 @@
+placeholder: ENC[AES256_GCM,data:tji/6di1F2GsD60TEBGAVvZR9m4jxQ8=,iv:BoBQVR735vq38iGx40VHIpk185ylf79mKmnpewcq/+o=,tag:lXNNk4/HYB0sw44KaQ2KYg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ZUk5cjhGTlVveUFRdHdS
+            elpVV0pZVU54U3plYjNBai9ZZVBxTDhyRFFnCmpGWW81VGJoMnd4eWxCWnovQnFF
+            WXR1MVBTZ3VRUnNMUjI5Rko4NHpBdjQKLS0tIDkxYWNxTmhUS2dYTkFnTWZXaS9V
+            ejdtSmF2M1ZVdFNiWENMWlNraUYxVzAKdlz4xLhTKjJfFESDcym2xCOa71rXj6BE
+            mdeaCDhE11CAXqrpKU+j0/kwTsZRzyqlwQsfeI4ratu1K1vY66ONsw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1a0v442ct2qfjcdhyktn25spw02yq4fl08plrrvuradwwxzsle4mq8thln4
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYT1hRSGt6TDRSMklQNDA3
+            Z2lYS2pMRWxxeEtGRGJSeXRDSlY5UTFBNEZvCm5RK0huT282MXpwWjdrTHByY3Ev
+            bTBMczR1MzVEcnNDVUxadlREbGg3UUUKLS0tIHhydUlmRExkbmNNNkVTcW1OSnpZ
+            aEtLZkRTRE9GZ0I1bEN0ZEl3RjVMeDgKoCY7NyxFMS+WuBUez2Irf91Xuy9QpM5g
+            RTmhK6mw2wd8oUMdgPOUESNwh1xkCz4hDHPrDQnfd4sPhSAvh28jwg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1n3uqtee5ymykrls6k04dznq50cwmj99hw7ny83yxjndt4y2ncf5qhjwa2p
+    lastmodified: "2026-09-08T13:29:12Z"
+    mac: ENC[AES256_GCM,data:YjMMIUdfCl8dkuvtvBZTFIhLwsUjI6iSeN929O4igbwpRTyGVxgLmAMl81YYHJSyEibelT7ZBKiuVVnL2KjLvAKTj3H1O+AQrcAEJDPC9NwPJwbtAIpLl2li5060Kdj4kr8AY+UJ2kHycuS9dg6wPZTLBJcM/YCw0AoVftvzryM=,iv:GEQZF9RvW+MJlMIjn1ToD74RubWMQtCyE5LqW9KQQfA=,tag:NR6u88eBY1asQZM6f45hTw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3