diff --git a/gitlab-runner.nix b/gitlab-runner.nix
index a0f45a1..0f9c3ba 100644
--- a/gitlab-runner.nix
+++ b/gitlab-runner.nix
@@ -1,30 +1,21 @@
 { pkgs, lib, config, ... }:
 
 {
+  age.secrets."secrets/ovni-token".file = ./secrets/ovni-token.age;
+
   services.gitlab-runner = {
     enable = true;
     services = {
-      # runner for executing stuff on host system (very insecure!)
-      # make sure to add required packages (including git!)
-      # to `environment.systemPackages`
-      shell = {
-        # File should contain at least these two variables:
-        # `CI_SERVER_URL`
-        # `REGISTRATION_TOKEN`
-        registrationConfigFile = "/run/secrets/gitlab-runner-registration";
+      ovni-shell = {
+        registrationConfigFile = config.age.secrets."secrets/ovni-token".path;
         executor = "shell";
         tagList = [ "nix" "xeon" ];
         environmentVariables = {
           SHELL = "${pkgs.bash}/bin/bash";
         };
       };
-
-      # runner for everything else
-      default = {
-        # File should contain at least these two variables:
-        # `CI_SERVER_URL`
-        # `REGISTRATION_TOKEN`
-        registrationConfigFile = "/run/secrets/gitlab-runner-registration";
+      ovni-docker = {
+        registrationConfigFile = config.age.secrets."secrets/ovni-token".path;
         dockerImage = "debian:stable";
         tagList = [ "docker" "xeon" ];
         registrationFlags = [ "--docker-network-mode host" ];
@@ -43,12 +34,6 @@
   systemd.services.gitlab-runner.serviceConfig.ExecStart = lib.mkForce
     ''${pkgs.gitlab-runner}/bin/gitlab-runner --debug run --config ''${HOME}/.gitlab-runner/config.toml --listen-address "127.0.0.1:9252" --working-directory ''${HOME}'';
 
-  # TODO https://docs.gitlab.com/runner/configuration/proxy.html
-  #systemd.services.docker.environment = {
-  #  HTTP_PROXY="http://localhost:23080/";
-  #  HTTPS_PROXY="http://localhost:23080/";
-  #};
-
   users.users.gitlab-runner = {
     uid = config.ids.uids.gitlab-runner;
     #isNormalUser = true;
diff --git a/secrets.nix b/secrets.nix
new file mode 100644
index 0000000..425f8c8
--- /dev/null
+++ b/secrets.nix
@@ -0,0 +1,8 @@
+let
+  root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII/1TNArcwA6D47mgW4TArwlxQRpwmIGiZDysah40Gb";
+  system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICO7jIp6JRnRWTMDsTB/aiaICJCl4x8qmKMPSs4lCqP1";
+  systems = [ root system ];
+in
+{
+  "secrets/ovni-token.age".publicKeys = systems;
+}
diff --git a/secrets/ovni-token.age b/secrets/ovni-token.age
new file mode 100644
index 0000000..8241b6d
--- /dev/null
+++ b/secrets/ovni-token.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 MSF3dg Ivlduky3TjzCthY9RB/Jb0+MouX2FYW06hoNdQ+f818
+NKnuQrTQBXjTArXG6/5KV5cdg/9JUk/l3vVdYq0fXOE
+-> ssh-ed25519 HY2yRg 1ZCKpZ7sXNPgllHoozCgyW8NqK2TCoyCYZdug6YeJkM
+BEeThDkjfaK9S5a81HcyaZv9zobKANVMEimduc/IO54
+-> &eB%}y-grease o;.XY Yirz }Xh\DG
+CkLRClqWRkCr7n8o5UV9+kdCik2iTG/dI1s666CKcgxbAPohmryJzOKdgRLyzCf0
+CSPMUfrixmuQtuShigtmY6Pm2A
+--- GEuNMnWZ3+B6QNXv7s7bfJdJ2bJAAW+jbfHQZ0UQB+k
+��3��.�-�Ӯ�ƿD���{\���%��R0�߷�����|�P�F��x�s�_P��x`4�,�z35�L��
�drj�2��^�
+��]�h�4~AP�‹�e3fT�E�l*�8z.���x2�0�7
\ No newline at end of file