diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
new file mode 100644
index 0000000..665b10e
--- /dev/null
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
diff --git a/.git-crypt/keys/default/0/ACE142C15F53182454DEE0802B45FEC5D0B181E7.gpg b/.git-crypt/keys/default/0/ACE142C15F53182454DEE0802B45FEC5D0B181E7.gpg
new file mode 100644
index 0000000..3b81302
Binary files /dev/null and b/.git-crypt/keys/default/0/ACE142C15F53182454DEE0802B45FEC5D0B181E7.gpg differ
diff --git a/.gitattributes b/.gitattributes
index 176a458..11412e8 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,2 @@
 * text=auto
+creds.json filter=git-crypt diff=git-crypt merge=git-crypt
diff --git a/.gitignore b/.gitignore
index b46becb..9b42106 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
 .direnv/
-creds.json
diff --git a/creds.json b/creds.json
new file mode 100644
index 0000000..2dd4329
Binary files /dev/null and b/creds.json differ
diff --git a/flake.nix b/flake.nix
index 716fbef..87a58b6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,6 +12,7 @@
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
             dnscontrol
+            git-crypt
           ];
         };
       }