diff --git a/.sops.yaml b/.sops.yaml
index 588f13a..ae29d82 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -29,6 +29,13 @@ creation_rules:
         - *gonne
         - *daniel
         - *lobon
+  - path_regex: nixos/machines/nyarlathotep/.*
+    key_groups:
+      - age:
+        - *nerf
+        - *gonne
+        - *daniel
+        - *nyarlathotep
   # this is the catchall clause if nothing above machtes. Encrypt to users but not
   # to machines
   - key_groups: