diff --git a/modules/nixos/clicks/security/secrets/groupPerms/default.nix b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
new file mode 100644
index 0000000..1f176ac
--- /dev/null
+++ b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, ... }: {
+  options.clicks.security.secrets.groupPerms.enable = lib.mkOption {
+    description = ''
+      Enable setting permissions for age secrets to 0440 rather than 0400 by
+      default, allowing group access
+
+      The default age permissions for secrets block the "group" from accessing
+      the secret, making that option useless without additionally specifying a
+      mode
+      '';
+    type = lib.types.bool;
+    default = config.clicks.security.secrets.enable;
+  };
+
+  options.age = {
+    secrets = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (submodule: {
+        config = {
+          mode = lib.pipe "0440" [
+            (lib.mkOverride 999)
+            (lib.mkIf config.clicks.security.secrets.groupPerms.enable)
+          ];
+        };
+      }));
+    };
+  };
+}