diff --git a/provision/hosts/bulwark/configuration.nix b/provision/hosts/bulwark/configuration.nix
index 36fc2e16..ed3c6910 100644
--- a/provision/hosts/bulwark/configuration.nix
+++ b/provision/hosts/bulwark/configuration.nix
@@ -94,6 +94,7 @@
     system = {
       ssh.enable = true;
       terminal.enable = true;
+      secrets.enable = true;
       wireguard-client.enable = false;
     };
   };