diff --git a/.gitignore b/.gitignore
index 0b2f056..75e114c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 migration-from-old-files/
 migration-from-docker/
 .decrypted~secret.enc.yaml
-gitea-backup/
\ No newline at end of file
+gitea-backup/
+*.agekey
diff --git a/.sops.yaml b/.sops.yaml
index fe46ea4..1a54ba9 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -41,3 +41,6 @@ creation_rules:
   - path_regex: tinyauth.*\.enc\.yaml$
     encrypted_regex: ^(data|stringData)$
     age: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
+  - path_regex: ntfy.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1uzs33ep6k3htnuwyyp54y373wkf7urd0qvk5kxcmptr5tt0fffus4v06gn
\ No newline at end of file
diff --git a/clusters/base/apps/ntfy/helmrelease.yaml b/clusters/base/apps/ntfy/helmrelease.yaml
index 27bc30f..dbd6f9f 100644
--- a/clusters/base/apps/ntfy/helmrelease.yaml
+++ b/clusters/base/apps/ntfy/helmrelease.yaml
@@ -29,6 +29,9 @@ spec:
               NTFY_AUTH_DEFAULT_ACCESS: deny-all
               NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
               NTFY_ENABLE_LOGIN: "true"
+            envFrom:
+              - secretRef:
+                  name: ntfy-secrets
             probes:
               liveness:
                 enabled: true
diff --git a/clusters/base/apps/ntfy/kustomization.yaml b/clusters/base/apps/ntfy/kustomization.yaml
index d7fbb03..69d4ba4 100644
--- a/clusters/base/apps/ntfy/kustomization.yaml
+++ b/clusters/base/apps/ntfy/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - helmrepository.yaml
   - helmrelease.yaml
+  - secret.enc.yaml
\ No newline at end of file
diff --git a/clusters/base/apps/ntfy/secret.enc.yaml b/clusters/base/apps/ntfy/secret.enc.yaml
new file mode 100644
index 0000000..edca788
--- /dev/null
+++ b/clusters/base/apps/ntfy/secret.enc.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ntfy-secrets
+    namespace: notify
+stringData:
+    #ENC[AES256_GCM,data:XneiueSaauWV0MEAzJcs730dwgrSt970o99Jq9iYbAF/RGAXPq0aMhSdNtK4PIgY5nSuVDsaGjXMEu+hF7kX4zWdIQg8MQ2n82fpcNc15RCMsyMNn9WVI1WKr5y7gonz5w==,iv:SPiP6hSzqdBk9WUVKT6TYp3qdZ3gje70CclLXaQNPkw=,tag:H8RtqMaF3bmMNUvfZMJtXQ==,type:comment]
+    NTFY_AUTH_USERS: ENC[AES256_GCM,data:Uk7Ho93dF6occuGT2+YgRpsUZubXrq7Bvo1CI03FRABR5iZWKhqa0TEfaC90zYRaef/0gqE40iepx293Vt35C4d3gGDCZRzs6Rz+KV520oxx0+CctDSQLO8sJGb71hcVEWceF3Le46+MZJ3vwMxTb+sJ4wQFh/FPds7gNqv6OTWYtmu950+O/i3GeB/PhAELzKE=,iv:6RIycaAZdGa8E3YVLT5QaeI9Zf0zF/zD6NZrn5uW2Ws=,tag:101j0x8gxpPAQ5QYRM6b5Q==,type:str]
+    NTFY_AUTH_ACCESS: ENC[AES256_GCM,data:5Ua2XuSZ2MtJNdWFASYze6pluI172iPA1/qoTYmqa2j0,iv:+tk0uiGOHpEIEBX4a9lnsEKpS3njS8FKrEgV2EKN0jU=,tag:ofFrrIPu/u59KprNaIdtWA==,type:str]
+sops:
+    age:
+        - recipient: age1uzs33ep6k3htnuwyyp54y373wkf7urd0qvk5kxcmptr5tt0fffus4v06gn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ZTg3RVF1Y2sxUjAzTVgw
+            d2ZkQVpmdzNqYzIwRVR1RGExUjM4SVRMSVN3Cis1bEpZNWZkY1VaWDkzUUlnN2RZ
+            TVUyZ2VNb0MvS3R5c283Ui9DRzkydUEKLS0tIFZMKzhJWnVZUVRsSFNHYStUaGti
+            aGFRSVg5alBnNnA4emxkeFFpZ3BnUFkKUPOqUjkjSl77Xvb3i+THWINbvtzrioqF
+            QBkQh5SSzq8fWrHoHHp7XHu02+p34dEJMOmEg1rlhu7pYRMNbbaRsQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-26T08:13:42Z"
+    mac: ENC[AES256_GCM,data:LPFcdVDHPXceeN7fpxgOPE6BFvCh2XBWmY7Q/ODACMNh+NtKt2feZ+FJbPaLzXXhwIpYtzcoStWb+eFLNIXRzowmfly87OTV6sYqAVAS4QGk1+E9K4AoepvwRSnCUXjm/uIer6DyTNbJ4CQG5s+mHb2LHvKNRpi3R/2v1OHDAJw=,iv:pos1aa5t5KtDvVftKJxKjl3J2i50rsRmElJ6Qp0v/Q8=,tag:FXR0puuma8eU7/U0zkzlOw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/clusters/home/apps/ntfy.yaml b/clusters/home/apps/ntfy.yaml
index 5766bbf..381c280 100644
--- a/clusters/home/apps/ntfy.yaml
+++ b/clusters/home/apps/ntfy.yaml
@@ -15,3 +15,7 @@ spec:
     - name: namespaces
     - name: infra
   retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-ntfy