diff --git a/files/sops/OMS-kone.yaml b/files/sops/OMS-kone.yaml
index d8fd163..c09779f 100644
--- a/files/sops/OMS-kone.yaml
+++ b/files/sops/OMS-kone.yaml
@@ -2,9 +2,10 @@
 #ENC[AES256_GCM,data:ITRmubrQRL6H5LBQttJmsOGnEA==,iv:Qb8ChChkrgew79iOQGFYdz42Z1pM6BLVME01OwlLfuw=,tag:F7xoOJ+xtWxmVY19Z8mefw==,type:comment]
 #ENC[AES256_GCM,data:hFjd28QRs4n5yulbo26Ohd0GHX/Dzpw7Sh/Ts4eZfGsr7RPFAot0OmamHt4Qpdz2kpivHdqO/0a7,iv:wBCY9TDW6VsCyJ7h8G/1NdCAYSnKRJhjOJFryZwhEL0=,tag:PcYkwsv4MJd9E8kwX2xNJw==,type:comment]
 wpa-psk: ENC[AES256_GCM,data:kn/SkxD2YSHXS8VrskE8GdW5GmCGIxkczoXiInJagcRWuq/xE7JDFRdaT9p/SBRbRESOzCvP7dzbCeoQ7h6Hpg==,iv:qZtAPVzjDCJ8En33c7n3dG0UiQK1VkNHMRtw6VBvtQ0=,tag:B88Vg5oFn8XjhAwUiClaSA==,type:str]
+wg-private-key: ENC[AES256_GCM,data:4irlnZLArzlEDF6H7J87RAbTSzd4DB4EF5PSjFI/fJieIuwKaAR1Q7a83dw=,iv:1zCLPVNqwvhCmkzypLjNIIe0kIgMTPeoUrHnGPaqfQc=,tag:N3BRacdX9EZFxPxwRAqWFw==,type:str]
 sops:
-    lastmodified: "2026-08-12T13:56:49Z"
-    mac: ENC[AES256_GCM,data:MY/ZEi/MzwHPSwTeXsnufRjf3hOs+zDtD8nPTTBbFOh+Xaes64wDI0hgIFn/RwKyMvwI0XIeA4dZ/UWsvZe5CId64JtJ5dxcmB9hUozIdtIT+20bmfhOFG7ww5X/5wimw9BjMjfP/hX+owB5G78LCa8dmNMkHEmybfK4WfwmC8c=,iv:lHO1bn+7mXtbRacj7qoVPIZyOe1BmShXIRFvUWf0MB0=,tag:MyC7ilGZwASppPhQZ2Fl3Q==,type:str]
+    lastmodified: "2026-08-14T11:24:51Z"
+    mac: ENC[AES256_GCM,data:xjKTuuchzNvUuui3DLfER+UsbS5lyGHAAjEPfJif4wGbsQH9tQTzWMzxCKNNsTZUoA4YxWRd4NCVm3AL85ezfGMKdL+9InPUcbJS29YJMqeYhqVEz4ZeTBxc8IV1l/5UUvsutFR6zfDT97Pami3EuhsHN3+sIEwpVvtZ6qbxkGM=,iv:oVKBmlMIYlxkZnskdRSB+RiedsX7kM+a3r78bBnnvdk=,tag:9boPNfiqIdUnuCgTk3NigA==,type:str]
     pgp:
         - created_at: "2026-08-12T13:05:39Z"
           enc: |-
diff --git a/modules/oms/systems.scm b/modules/oms/systems.scm
index be1c724..2972401 100644
--- a/modules/oms/systems.scm
+++ b/modules/oms/systems.scm
@@ -142,7 +142,10 @@ ID with the extended system as it's value."
                #:firmware (list ibt-hw-firmware iwlwifi-firmware)))
         (wpa-psk (sops-secret
                    (key '("wpa-psk"))
-                   (file (channel-file "sops/OMS-kone.yaml")))))
+                   (file (channel-file "sops/OMS-kone.yaml"))))
+        (wg-key (sops-secret
+                  (key '("wg-private-key"))
+                  (file (channel-file "sops/OMS-kone.yaml")))))
     (operating-system
       (inherit base)
       (kernel-arguments %default-kernel-arguments)
@@ -172,7 +175,7 @@ ID with the extended system as it's value."
                          (ruleset (channel-file "OMS-kone/nftables.rules"))))
               (service sops-secrets-service-type
                        (sops-service-configuration
-                         (secrets (list wpa-psk))))
+                         (secrets (list wpa-psk wg-key))))
               (service static-networking-service-type
                        (list (static-networking
                                (provision '(wifi-ip))
@@ -190,7 +193,7 @@ ID with the extended system as it's value."
                                (allowed-ips '("192.168.3.3/32"))
                                (keep-alive 25))))
                          (addresses '("192.168.3.2/24"))
-                         (private-key "/etc/wireguard/oms-kone.key")
+                         (private-key (sops-secret->secret-file wg-key))
                          (shepherd-requirement '(networking)))))
         (modify-services (operating-system-user-services base)
           (elogind-service-type config =>