diff --git a/flake.nix b/flake.nix
index 733b853..6b4d8eb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -77,16 +77,28 @@
             ./machines/chai
             commonConfig
             ({pkgs, ...}: {
-              config.nixpkgs.overlays = [
-                (_: _: {
-                  py36 = import nixpkgs-py36 {inherit (pkgs) system;};
-                })
-              ];
-            })
-            ({pkgs, ...}: {
-              home-manager.users.${username}.programs = {
-                git.package = pkgs.gitSVN;
-                firefox.profiles.default.bookmarks = [(import ./apps/firefox/work.nix)];
+              config = {
+                nixpkgs.overlays = [
+                  (_: _: {
+                    py36 = import nixpkgs-py36 {inherit (pkgs) system;};
+                  })
+                ];
+                home-manager.users.${username}.programs = {
+                  git.package = pkgs.gitSVN;
+                  firefox.profiles.default.bookmarks = [(import ./apps/firefox/work.nix)];
+                };
+                age.secrets = {
+                  netrc = {
+                    file = ./secrets/work/netrc.age;
+                    owner = username;
+                    path = "/home/${username}/.netrc";
+                  };
+                  pipconf = {
+                    file = ./secrets/work/pip.conf.age;
+                    owner = username;
+                    path = "/home/${username}/.config/pip/pip.conf";
+                  };
+                };
               };
             })
           ];
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 6ac0e02..78ae2ee 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -9,4 +9,6 @@ in {
   "shared/ssh-config-work.age".publicKeys = all;
   "shared/spotify-pw.age".publicKeys = all;
   "shared/irc-pw.age".publicKeys = all;
+  "work/netrc.age".publicKeys = [jolheiser chai];
+  "work/pip.conf.age".publicKeys = [jolheiser chai];
 }
diff --git a/secrets/work/netrc.age b/secrets/work/netrc.age
new file mode 100644
index 0000000..7bf8cb0
--- /dev/null
+++ b/secrets/work/netrc.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g BkWGdkvZQHZ0DLnmC4SdTSsGV97RHCNf0I4rZTQHRyk
+kNuqhd6nyl3G4TiAEQ1ipfSBqdeg167S7FHZMB1g8Ao
+-> ssh-ed25519 jo1MPA O+LOCoi56qdnRjpvuCIgSqcMW5qAqZsTS3LG0hKhYGo
+0Ckl+Egbu902uwh4H6CdZJmYwC/A/GAW4eQhvuzk1wU
+-> s#Y#w#OL-grease fx`@|l9 G
+NjEM1qmkUfkzASIb6nR7oJZ85ct+UunHmmzhwn/0s9V/vHHG+lk6Jy37O3cIum0
+--- UiE8jly5e1JBtjEM/z/IVoFWneKfl927V0o3vrLBHjY
+�^���_:3��ep^X���`�h�sB(G���̤& ��Ǣ�:�A�����n�� ���+��s�s]���r�'x�P޸��C��Aژ�#'���T�(���9�n(E8O81#��O���J��uK��
�a`�£�����^p�/
\ No newline at end of file
diff --git a/secrets/work/pip.conf.age b/secrets/work/pip.conf.age
new file mode 100644
index 0000000..6babee3
Binary files /dev/null and b/secrets/work/pip.conf.age differ