diff --git a/modules/home/rsydn/base.nix b/modules/home/rsydn/base.nix
index 0335de9..0a0cd14 100644
--- a/modules/home/rsydn/base.nix
+++ b/modules/home/rsydn/base.nix
@@ -47,5 +47,54 @@
 
   rsydn.languages.enable = lib.mkDefault true;
 
-  rsydn.secrets.enable = lib.mkDefault true;
+  rsydn.secrets = {
+    enable = lib.mkDefault true;
+    defaultSopsFile = ../../../secrets/local-ai-tokens.sops.yaml;
+    secrets = {
+      "openai-api-key" = {
+        format = "yaml";
+        key = "OPENAI_API_KEY";
+      };
+
+      "openrouter-api-key" = {
+        format = "yaml";
+        key = "OPENROUTER_API_KEY";
+      };
+
+      "zai-api-key" = {
+        format = "yaml";
+        key = "ZAI_API_KEY";
+      };
+
+      "moonshot-api-key" = {
+        format = "yaml";
+        key = "MOONSHOT_API_KEY";
+      };
+
+      "anthropic-api-key" = {
+        format = "yaml";
+        key = "ANTHROPIC_API_KEY";
+      };
+
+      "exa-api-key" = {
+        format = "yaml";
+        key = "EXA_API_KEY";
+      };
+
+      "fal-api-key" = {
+        format = "yaml";
+        key = "FAL_API_KEY";
+      };
+
+      "groq-api-key" = {
+        format = "yaml";
+        key = "GROQ_API_KEY";
+      };
+
+      "firecrawl-api-key" = {
+        format = "yaml";
+        key = "FIRECRAWL_API_KEY";
+      };
+    };
+  };
 }
diff --git a/modules/home/rsydn/devtools/ai-tools.nix b/modules/home/rsydn/devtools/ai-tools.nix
index 4be7384..fdc9862 100644
--- a/modules/home/rsydn/devtools/ai-tools.nix
+++ b/modules/home/rsydn/devtools/ai-tools.nix
@@ -1,14 +1,7 @@
 { config, lib, pkgs, inputs, ... }:
 let
   inherit (lib)
-    mkEnableOption
-    mkOption
-    types
-    mkIf
-    concatMap
-    unique
-    warn
-    escapeShellArg;
+    mkEnableOption mkOption types mkIf concatMap unique warn escapeShellArg;
   cfg = config.rsydn.aiTools;
 
   nodePackages = if builtins.hasAttr "nodePackages_latest" pkgs then
@@ -51,13 +44,8 @@ let
   claudeDefault =
     choosePackage [ (getNodePackage "@anthropic-ai/claude-code") ];
 
-  toolOption =
-    { name
-    , description
-    , defaultPackage
-    , extraOptions ? { }
-    , extraDefaults ? { }
-    }:
+  toolOption = { name, description, defaultPackage, extraOptions ? { }
+    , extraDefaults ? { } }:
     mkOption {
       type = types.submodule {
         options = {
@@ -113,39 +101,39 @@ let
     }
   ];
 
-  zaiWrapperPackages =
-    let
-      claudeCfg = cfg.claude;
-      zaiCfg = claudeCfg.zai or { enable = false; };
-    in if claudeCfg.enable && zaiCfg.enable then
-      if claudeCfg.package != null then
-        let
-          claudeExe = lib.getExe claudeCfg.package;
-          commandName = zaiCfg.commandName;
-          baseUrl = zaiCfg.baseUrl;
-          model = zaiCfg.model;
-          tokenEnvVar = zaiCfg.tokenEnvVar;
-        in [
-          (pkgs.writeShellApplication {
-            name = commandName;
-            text = ''
-              if [ -z "''${${tokenEnvVar}:-}" ]; then
-                echo "${commandName}: environment variable ${tokenEnvVar} is not set" >&2
-                exit 1
-              fi
+  zaiWrapperPackages = let
+    claudeCfg = cfg.claude;
+    zaiCfg = claudeCfg.zai or { enable = false; };
+  in if claudeCfg.enable && zaiCfg.enable then
+    if claudeCfg.package != null then
+      let
+        claudeExe = lib.getExe claudeCfg.package;
+        commandName = zaiCfg.commandName;
+        baseUrl = zaiCfg.baseUrl;
+        model = zaiCfg.model;
+        tokenEnvVar = zaiCfg.tokenEnvVar;
+      in [
+        (pkgs.writeShellApplication {
+          name = commandName;
+          text = ''
+            if [ -z "''${${tokenEnvVar}:-}" ]; then
+              echo "${commandName}: environment variable ${tokenEnvVar} is not set" >&2
+              exit 1
+            fi
 
-              export ANTHROPIC_BASE_URL=${escapeShellArg baseUrl}
-              export ANTHROPIC_AUTH_TOKEN="''${${tokenEnvVar}}"
-              export ANTHROPIC_MODEL=${escapeShellArg model}
+            export ANTHROPIC_BASE_URL=${escapeShellArg baseUrl}
+            export ANTHROPIC_AUTH_TOKEN="''${${tokenEnvVar}}"
+            export ANTHROPIC_MODEL=${escapeShellArg model}
 
-              exec ${claudeExe} "$@"
-            '';
-          })
-        ]
-      else
-        warn "rsydn.aiTools.claude: Z.AI wrapper requested but package is null" [ ]
+            exec ${claudeExe} "$@"
+          '';
+        })
+      ]
     else
-      [ ];
+      warn "rsydn.aiTools.claude: Z.AI wrapper requested but package is null"
+      [ ]
+  else
+    [ ];
 
 in {
   options.rsydn.aiTools = {
@@ -225,6 +213,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    home.packages = unique (toolPackages ++ zaiWrapperPackages ++ cfg.extraPackages);
+    home.packages =
+      unique (toolPackages ++ zaiWrapperPackages ++ cfg.extraPackages);
   };
 }
diff --git a/secrets/local-ai-tokens.sops.yaml b/secrets/local-ai-tokens.sops.yaml
new file mode 100644
index 0000000..296a850
--- /dev/null
+++ b/secrets/local-ai-tokens.sops.yaml
@@ -0,0 +1,26 @@
+OPENAI_API_KEY: ENC[AES256_GCM,data:+3NBsL06StOplxhn05jSBGD06bTrJBaKjjBdE7bclTH3RStMTVhs6lXHEqrFMJ1cLpEh+AFR7gE=,iv:hH+ElXuDFfJ2Pr9jr3vZMOpRV0sDKV/CtnVm4dTHNl8=,tag:zTV/2Zhxz15yHJmxhyNXvA==,type:str]
+OPENROUTER_API_KEY: ENC[AES256_GCM,data:ToATfynUhY4df2ax6SywCpUCHl4JsOEi/yMcBhg8/7ulOq6Cqq5U2VKgtpA38Cr6qbJTOtZXVtNU2YUwdz8LQtGOoLqHp2pTaA==,iv:UZta/z68CZkGkzhPRH/EFAVhFO3G9fAE9a0zmBQm1kg=,tag:bkPjdaeSl/Hxed9gdtyhSg==,type:str]
+ZAI_API_KEY: ENC[AES256_GCM,data:/dwCvRmNF9n0c/yKs3ii/pSku6+g03JBXv4AauNvjaU+0plsE3xdWL+B4mGE10HAsQ==,iv:3zUAJnsWigBaqDc6BuOLecSq0S1D9EpBOkMHVifHF6c=,tag:0sW0UcTGiYNWBksiAwHF7A==,type:str]
+MOONSHOT_API_KEY: ENC[AES256_GCM,data:WhPRdFqUcOJctdowxsCAX/2qzMuWJ5P7JnvpNqGg+8mPxIPx5ybnG+6XQ3nYkZONJx8j,iv:v7rh6AHnSb4BLhthDbU4Q3UhV5YzcwO4xe2M9/0nY54=,tag:w1w4Si8aiizsr5r+nQUyUg==,type:str]
+GROQ_API_KEY: ENC[AES256_GCM,data:0UwJWQNxzfMaeBEvhqc5h37xTAoIq3Ld+AenEL16SVVLaogtMSaxHX1B5pn7XiEz/ermPLYq8/c=,iv:2Cb5OLKYDBvcogXHGIK50eKx4uAkfxj27RaLBzPNM9M=,tag:fz+v1NU1nh4Hg/rwvu35oA==,type:str]
+FIRECRAWL_API_KEY: ENC[AES256_GCM,data:W48XK3/SjIuQUANEZ2tCWU+uQK4RKzPZE8hpkHopydUl/dQ=,iv:we/6fCvmXfaTE91/EIO09AryyUh3HGWvSPEaKb8IRSY=,tag:OHP2ryFhww9y8ueaxauuPA==,type:str]
+FAL_API_KEY: ENC[AES256_GCM,data:lyfSFpJYExZBY/gsiPAGJtPUREUMBPWB/wY9A6CG2P+i0vOBuem/8exud2bIIY70UNvGZz0wV+GxSvZvIkkHjVFTahLu,iv:D5ysGAwOKMhBWJ5OSL4djyLTngQqS1K+9jUNWnU6ors=,tag:3ZDED4pAGWl4jrvaxEu9Lw==,type:str]
+EXA_API_KEY: ENC[AES256_GCM,data:rMNonp76DeS1VtZuvs45Fwhj2aIVfoNWENHp3J9OxajK8uYC,iv:FroyalXHrrx+0SYSymVBCsFTuVOMzFQGAwicSxrE7a4=,tag:36MTbKeswrexO7dFe/wR1A==,type:str]
+ANTHROPIC_API_KEY: ENC[AES256_GCM,data:aBgfgHQ8cyJ4TUq4O6y218flTgDWcAXatY0/xbaD3AVvirCaEUXfsPP+0ySlVxlzx8hj9gMizlY2gJkNarsgwHCikOtmh/ZCxbQMbwogByqdV3C4myY7UwMgZdYzZGaQBL0JWR6ZZjf9ZK2T,iv:QB2tYhBtOU45Ho65FwQhD2H6gv7VobDXWgV/S9qu/yc=,tag:TTkEyjiTHYA1ZnMMwHwk4g==,type:str]
+OPENCODE_API_KEY: ENC[AES256_GCM,data:2aPaiODhpFObObRN+/HiEVsvMds1n6MhrmvQUWo2ozRzgRHQ1dGGZYFzOZoSbV4vpjmiqKW7VUFnVU5va1xlS8HrWg==,iv:DgCF9I+wT9xUjmenfUSDrDnKD5Ai4pJGw4qKmePpZOo=,tag:YD7nO4HbDKTa3zNbGtUCOg==,type:str]
+BRAVE_SEARCH_API_KEY: ENC[AES256_GCM,data:7Q+8sa2Xp4amEMkGzgEZzSLDCkstL71lu3sz1iGJdg==,iv:pY4NMgIUEEqwBUonAOAVoqP0EeqgON7h23221Yoa4aM=,tag:foyjDNIMsxrKvgYmu6FJNA==,type:str]
+sops:
+    age:
+        - recipient: age1qfgey5w87dresg99zed3d2yz62hv6c2c7u4gd5e880vjrngmx9ksgfv3sj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaFFBQ3RQZEZBelhKdVla
+            cldzbnoxQUxPS3lacE1SZGlTL2t1cXMyRFUwCklXKzlvNVlQZXROM0thS1FDQWNy
+            Um5yRkgvUnlsdVlQRmowYkg4eHp2Y00KLS0tIGJOOERDSE5oQm9xaVg4WUFUa3Nh
+            WHRrVWx2Y3FabWpBdjZ5VkpFY1BGeGsKSc4vxaHSj/6g7clPZDOPqCf3Zo+VGSRy
+            HwLiHEohjk5/R3I5KWhFuO9aNQTNYYnUBwc6nOAcEhw+Mihq2gDtzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-09-30T16:59:49Z"
+    mac: ENC[AES256_GCM,data:HmA7khtD8oapqPPZ7AxZjxSwkqmhGb0TP6u2S6q20I/B/xittoH3EGs5bq9AaeY9wGAkxper3VlPXsBXs67pOZVJOuB/0h22DlOvrI6eS83y5ZSc+lPQgfK+/93LwbWhSe6l5EKRTGSHZMclr+raMsbjRPP/zl9Lf26fkz79XCI=,iv:73kl7xWE1slcc3YmR7lVsRYvsLW8XQ67qE9GfgBuRRU=,tag:f4LyjoGOgC7tYcFGNgpXlw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2