diff --git a/flake.nix b/flake.nix
index ef628c8..8a8b302 100644
--- a/flake.nix
+++ b/flake.nix
@@ -262,6 +262,7 @@
             }
             inputs.home-manager.nixosModules.home-manager
             agenix.nixosModules.default
+            agenix-rekey.nixosModules.default
             ./hosts/lazyworkhorse/configuration.nix
             ./hosts/lazyworkhorse/hardware-configuration.nix
             ./modules/nixos/filesystem/hoardingcow-mount.nix
diff --git a/hosts/lazyworkhorse/configuration.nix b/hosts/lazyworkhorse/configuration.nix
index 41de1e7..bf92d4b 100644
--- a/hosts/lazyworkhorse/configuration.nix
+++ b/hosts/lazyworkhorse/configuration.nix
@@ -588,4 +588,10 @@
   };
 
 
-}
\ No newline at end of file
+}
+  # agenix-rekey — automatic re-encryption for each target host
+  age.rekey = {
+    masterIdentities = [
+      "/home/gortium/.ssh/gortium_ssh_key"
+    ];
+  };
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index d7fcec7..d94174d 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -12,5 +12,7 @@ in
   "home_wifi.age".publicKeys = authorizedKeys;
   "lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys;
   "n8n_ssh_key.age".publicKeys = authorizedKeys;
-  "builder_key.age".publicKeys = authorizedKeys;
+"builder_key.age".publicKeys = authorizedKeys ++ [
+    keys.hosts.uConsole.bootstrap
+  ];
 }