diff --git a/modules/tokens.nix b/modules/tokens.nix
new file mode 100644
index 0000000..c80a30d
--- /dev/null
+++ b/modules/tokens.nix
@@ -0,0 +1,14 @@
+{ config, ... }: {
+  config = {
+    nix.extraOptions = ''
+      !include ${config.sops.secrets.access-tokens.path}
+    '';
+
+    sops.secrets.access-tokens = {
+      mode = "0440";
+      group = config.users.groups.keys.name;
+      sopsFile = ../secrets/access-tokens;
+      format = "binary";
+    };
+  };
+}