diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 8838cb84..49f017c5 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -4,8 +4,11 @@
       "Bash(nix flake check)",
       "Bash(rg:*)",
       "Bash(mkdir:*)",
-      "Bash(git add:*)"
+      "Bash(git add:*)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:github.com)",
+      "WebSearch"
     ],
     "deny": []
   }
-}
\ No newline at end of file
+}
diff --git a/home/default.nix b/home/default.nix
index 07415134..9bd4d358 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   lib,
   hostname,
@@ -9,6 +10,10 @@
     ./services.nix
   ];
 
+  age.identityPaths = [
+    "${config.home.homeDirectory}/.ssh/id_ed25519_agenix"
+  ];
+
   rc = lib.mkMerge [
     {
       editor.enable = true;
diff --git a/home/key.pub b/home/key.pub
new file mode 100644
index 00000000..29ef1835
--- /dev/null
+++ b/home/key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2+zD2rG/UzIClZ1MgSrzMlWdj9ljzcSzwuH8dHXP1a agenix
diff --git a/home/programs/aichat.nix b/home/programs/aichat.nix
new file mode 100644
index 00000000..b47c32b5
--- /dev/null
+++ b/home/programs/aichat.nix
@@ -0,0 +1,19 @@
+{config, ...}: {
+  age.secrets.aichat-env = {
+    file = ../secrets/aichat-env.age;
+  };
+
+  programs.aichat = {
+    enable = true;
+    settings = {
+      model = "claude:claude-sonnet-4-20250514";
+      clients = [
+        {type = "claude";}
+      ];
+    };
+  };
+
+  programs.zsh.sessionVariables = {
+    AICHAT_ENV_FILE = config.age.secrets.aichat-env.path;
+  };
+}
diff --git a/home/programs/default.nix b/home/programs/default.nix
index 2dc56c70..616e142b 100644
--- a/home/programs/default.nix
+++ b/home/programs/default.nix
@@ -1,5 +1,6 @@
 {pkgs, ...}: {
   imports = [
+    ./aichat.nix
     ./starship.nix
     ./tmux.nix
     ./zsh.nix
diff --git a/home/secrets/aichat-env.age b/home/secrets/aichat-env.age
new file mode 100644
index 00000000..0cccad34
Binary files /dev/null and b/home/secrets/aichat-env.age differ
diff --git a/lib/hosts.nix b/lib/hosts.nix
index 44723275..3f2420f9 100644
--- a/lib/hosts.nix
+++ b/lib/hosts.nix
@@ -34,6 +34,7 @@ inputs @ {
     home-manager.users.${username} = {...}: {
       imports =
         [
+          agenix.homeManagerModules.default
           ./../modules/home
           ./../home
         ]
diff --git a/lib/keys.nix b/lib/keys.nix
index e928f0c4..39dd1f30 100644
--- a/lib/keys.nix
+++ b/lib/keys.nix
@@ -14,3 +14,6 @@ let
     ];
 in
   builtins.listToAttrs hostKeyPairs
+  // {
+    home = firstLine (builtins.readFile ./../home/key.pub);
+  }
diff --git a/lib/secrets.nix b/lib/secrets.nix
index 5a21f367..ad8bf93d 100644
--- a/lib/secrets.nix
+++ b/lib/secrets.nix
@@ -5,8 +5,10 @@ let
   glyphSecrets = import ./secrets/glyph.nix;
   sporeSecrets = import ./secrets/spore.nix;
   zetaSecrets = import ./secrets/zeta.nix;
+  homeSecrets = import ./secrets/home.nix;
 in
   globalSecrets
   // glyphSecrets
   // sporeSecrets
   // zetaSecrets
+  // homeSecrets
diff --git a/lib/secrets/home.nix b/lib/secrets/home.nix
new file mode 100644
index 00000000..0da6c71c
--- /dev/null
+++ b/lib/secrets/home.nix
@@ -0,0 +1,5 @@
+let
+  keys = with (import ../keys.nix); [home Rhizome];
+in {
+  "home/secrets/aichat-env.age".publicKeys = keys;
+}