diff --git a/modules/nixos/clicks/security/secrets/default.nix b/modules/nixos/clicks/security/secrets/default.nix
new file mode 100644
index 0000000..9a97f9d
--- /dev/null
+++ b/modules/nixos/clicks/security/secrets/default.nix
@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: 2024 Auxolotl Infrastructure Contributors
+# SPDX-FileCopyrightText: 2024 Clicks Codes
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+{ config, lib, pkgs, inputs, ... }: let
+  cfg = config.clicks.security.secrets;
+in {
+  options.clicks.security.secrets.enable = lib.mkOption {
+    description = "Enable using agenix-rekey for secrets";
+    type = lib.types.bool;
+    default = true;
+  };
+
+  config = lib.mkIf cfg.enable {
+    age.rekey = {
+      masterIdentities = [
+        "${inputs.self}/secrets/keys/minion/collabora-yubikey.pub"
+        "${inputs.self}/secrets/keys/minion/tiny-yubikey.pub"
+        "${inputs.self}/secrets/keys/minion/iyubikey.pub"
+      ];
+      storageMode = "local";
+      generatedSecretsDir = lib.snowfall.fs.get-snowfall-file "secrets/generated/${config.networking.hostName}";
+      localStorageDir = lib.snowfall.fs.get-snowfall-file "secrets/rekeyed/${config.networking.hostName}";
+    };
+
+    age.identityPaths = lib.mkIf config.clicks.storage.impermanence.enable [
+      "/persist/data/etc/ssh/ssh_host_ed25519_key"
+      "/persist/data/etc/ssh/ssh_host_rsa_key"
+    ];
+  };
+}