diff --git a/flake.nix b/flake.nix
index 733b8532980769e1b0724f4e4edac312a3422c16..6b4d8ebe9073a83d5b567efe0e7d26890a900fa2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -77,16 +77,28 @@             ./machines/common
             ./machines/chai
             commonConfig
             ({pkgs, ...}: {
-              config.nixpkgs.overlays = [
-                (_: _: {
-                  py36 = import nixpkgs-py36 {inherit (pkgs) system;};
-                })
-              ];
-            })
-            ({pkgs, ...}: {
-              home-manager.users.${username}.programs = {
-                git.package = pkgs.gitSVN;
-                firefox.profiles.default.bookmarks = [(import ./apps/firefox/work.nix)];
+              config = {
+                nixpkgs.overlays = [
+                  (_: _: {
+                    py36 = import nixpkgs-py36 {inherit (pkgs) system;};
+                  })
+                ];
+                home-manager.users.${username}.programs = {
+                  git.package = pkgs.gitSVN;
+                  firefox.profiles.default.bookmarks = [(import ./apps/firefox/work.nix)];
+                };
+                age.secrets = {
+                  netrc = {
+                    file = ./secrets/work/netrc.age;
+                    owner = username;
+                    path = "/home/${username}/.netrc";
+                  };
+                  pipconf = {
+                    file = ./secrets/work/pip.conf.age;
+                    owner = username;
+                    path = "/home/${username}/.config/pip/pip.conf";
+                  };
+                };
               };
             })
           ];

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 6ac0e02ad5b636359b513be611792240d1d883bd..78ae2ee423b07fc5a3b89a7f35d9632b3665539d 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -9,4 +9,6 @@   "shared/ssh-config.age".publicKeys = all;
   "shared/ssh-config-work.age".publicKeys = all;
   "shared/spotify-pw.age".publicKeys = all;
   "shared/irc-pw.age".publicKeys = all;
+  "work/netrc.age".publicKeys = [jolheiser chai];
+  "work/pip.conf.age".publicKeys = [jolheiser chai];
 }

diff --git a/secrets/work/netrc.age b/secrets/work/netrc.age
new file mode 100644
index 0000000000000000000000000000000000000000..7bf8cb0942d44b170dfaaa8a255675f670f3141e
--- /dev/null
+++ b/secrets/work/netrc.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 E8j6/g BkWGdkvZQHZ0DLnmC4SdTSsGV97RHCNf0I4rZTQHRyk
+kNuqhd6nyl3G4TiAEQ1ipfSBqdeg167S7FHZMB1g8Ao
+-> ssh-ed25519 jo1MPA O+LOCoi56qdnRjpvuCIgSqcMW5qAqZsTS3LG0hKhYGo
+0Ckl+Egbu902uwh4H6CdZJmYwC/A/GAW4eQhvuzk1wU
+-> s#Y#w#OL-grease fx`@|l9 G
+NjEM1qmkUfkzASIb6nR7oJZ85ct+UunHmmzhwn/0s9V/vHHG+lk6Jy37O3cIum0
+--- UiE8jly5e1JBtjEM/z/IVoFWneKfl927V0o3vrLBHjY
+��^���_:3��ep^X����`�h�sB(G���̤& ��Ǣ�:�A������n�� �����+��s�s]���r�'x�P޸��C��Aژ�#'����T�(���9�n(E8O81#��O���J��uK��
�a`�£�����^p�/
\ No newline at end of file

diff --git a/secrets/work/pip.conf.age b/secrets/work/pip.conf.age
new file mode 100644
index 0000000000000000000000000000000000000000..6babee35dcb82f9040aa7a6c71a77d5b23b304d5
Binary files /dev/null and b/secrets/work/pip.conf.age differ