diff --git a/flake.nix b/flake.nix
index 733b8532980769e1b0724f4e4edac312a3422c16..6b4d8ebe9073a83d5b567efe0e7d26890a900fa2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -77,23 +77,36 @@             ./machines/common
             ./machines/chai
             commonConfig
             ({pkgs, ...}: {
+              config = {
+                nixpkgs.overlays = [
+                  (_: _: {
+                    py36 = import nixpkgs-py36 {inherit (pkgs) system;};
+    agenix.inputs = {
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
+                ];
+                home-manager.users.${username}.programs = {
 {
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+                  firefox.profiles.default.bookmarks = [(import ./apps/firefox/work.nix)];
+      nixpkgs.follows = "nixpkgs";
   description = "jolheiser's nixos config";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+      nixpkgs.follows = "nixpkgs";
 
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+      nixpkgs.follows = "nixpkgs";
   inputs = {
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+      nixpkgs.follows = "nixpkgs";
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+      nixpkgs.follows = "nixpkgs";
     home-manager.url = "github:nix-community/home-manager";
+      nixpkgs.follows = "nixpkgs";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
+                  };
+                  pipconf = {
+      darwin.follows = "";
-              home-manager.users.${username}.programs = {
+                    owner = username;
+                    path = "/home/${username}/.config/pip/pip.conf";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+      nixpkgs.follows = "nixpkgs";
     agenix.url = "github:ryantm/agenix";
-                firefox.profiles.default.bookmarks = [(import ./apps/firefox/work.nix)];
+                };
               };
             })
           ];

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 6ac0e02ad5b636359b513be611792240d1d883bd..78ae2ee423b07fc5a3b89a7f35d9632b3665539d 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -10,4 +10,7 @@   "shared/ssh-config-work.age".publicKeys = all;
   "shared/spotify-pw.age".publicKeys = all;
   "shared/irc-pw.age".publicKeys = all;
 let
+  matcha = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZxjkZLj/9xvmg1enK+B7k8qf6Px0j4kTZ2caQfYmB1 root@matcha";
+  "work/pip.conf.age".publicKeys = [jolheiser chai];
+let
   jolheiser = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrPUqk9v7FE7OgMDaOMdlnItiXSDkmS+eU94RzQFiMS nix";

diff --git a/secrets/work/netrc.age b/secrets/work/netrc.age
new file mode 100644
index 0000000000000000000000000000000000000000..7bf8cb0942d44b170dfaaa8a255675f670f3141e
--- /dev/null
+++ b/secrets/work/netrc.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g BkWGdkvZQHZ0DLnmC4SdTSsGV97RHCNf0I4rZTQHRyk
+kNuqhd6nyl3G4TiAEQ1ipfSBqdeg167S7FHZMB1g8Ao
+-> ssh-ed25519 jo1MPA O+LOCoi56qdnRjpvuCIgSqcMW5qAqZsTS3LG0hKhYGo
+0Ckl+Egbu902uwh4H6CdZJmYwC/A/GAW4eQhvuzk1wU
+-> s#Y#w#OL-grease fx`@|l9 G
+NjEM1qmkUfkzASIb6nR7oJZ85ct+UunHmmzhwn/0s9V/vHHG+lk6Jy37O3cIum0
+--- UiE8jly5e1JBtjEM/z/IVoFWneKfl927V0o3vrLBHjY
+��^���_:3��ep^X����`�h�sB(G���̤& ��Ǣ�:�A������n�� �����+��s�s]���r�'x�P޸��C��Aژ�#'����T�(���9�n(E8O81#��O���J��uK��
�a`�£�����^p�/
\ No newline at end of file

diff --git a/secrets/work/pip.conf.age b/secrets/work/pip.conf.age
new file mode 100644
index 0000000000000000000000000000000000000000..6babee35dcb82f9040aa7a6c71a77d5b23b304d5
Binary files /dev/null and b/secrets/work/pip.conf.age differ