diff --git a/.sops.yaml b/.sops.yaml
index d5a8ba98..49f37952 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,9 +5,9 @@ keys:
   - &ni age1dm9xugju4q5gx0zty8ckw655ea904c64gv9qw9fn3lu507ck8uzsag59y8
   - &plover age1sj497yr895335rk77qqnrqyx9f7462ma3lz0a0x3w5cnla5uqgpspgggtz
 creation_rules:
-  - path_regex: hosts/ni/secrets/[^/]+\.(yaml|json)$
+  - path_regex: hosts/ni/(modules/\w+/secret|secrets/[^/]+)\.(yaml|json)$
     age: *ni
-  - path_regex: hosts/plover/secrets/[^/]+\.(yaml|json)$
+  - path_regex: hosts/plover/(modules/\w+/secret|secrets/[^/]+)\.(yaml|json)$
     age: *plover
   - path_regex: users/home-manager/foo-dogsquared/[^/]+\.(yaml|json)$
     key_groups:
@@ -15,10 +15,3 @@ creation_rules:
         - *foo-dogsquared-age
       - gpg:
         - *foo-dogsquared
-  - path_regex: secrets/[^/]+\.(yaml|json)$
-    key_groups:
-      - age:
-        - *foo-dogsquared-age
-        - *ni
-        pgp:
-        - *foo-dogsquared