diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..fa2b892
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,6 @@
+creation_rules:
+  - path_regex: '(^|[\\/]).*\.sops\.ya?ml$'
+    age:
+      - age1ua9qahphsqf2x8ew2n4umapp23a66t0eccccc0d5etp82n8tsqgsfc8qjk  # me
+      - age1nw388umnlxfj3cg9lqjyltghfx6w709nam8s2x826c3nxla9famq3uya73  # server
+    encrypted_regex: '^(DB_PASSWORD|API_KEY)$'