diff --git a/flux-applications/shiki-natsume.yaml b/flux-applications/shiki-natsume.yaml
index 3611fe7..f138366 100644
--- a/flux-applications/shiki-natsume.yaml
+++ b/flux-applications/shiki-natsume.yaml
@@ -12,3 +12,7 @@ spec:
   sourceRef:
     kind: GitRepository
     name: applications
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
diff --git a/shiki-natsume/.sops.yaml b/shiki-natsume/.sops.yaml
new file mode 100644
index 0000000..2fc872c
--- /dev/null
+++ b/shiki-natsume/.sops.yaml
@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: '.*.yaml'
+    encrypted_regex: '^(data|stringData)$'
+    pgp: A638A6B54530D54E868F9D3238736C662F799E0D
diff --git a/shiki-natsume/kustomization.yaml b/shiki-natsume/kustomization.yaml
index 7aff512..af8e5ee 100644
--- a/shiki-natsume/kustomization.yaml
+++ b/shiki-natsume/kustomization.yaml
@@ -7,3 +7,4 @@ generatorOptions:
 resources:
   - ns.natsume.yaml
   - deploy.natsume.yaml
+  - secret.yaml
diff --git a/shiki-natsume/secret.yaml b/shiki-natsume/secret.yaml
new file mode 100644
index 0000000..1bf092d
--- /dev/null
+++ b/shiki-natsume/secret.yaml
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+    name: natsume-secret
+data:
+    token: ENC[AES256_GCM,data:wJuD9+RWShdraQ75TsMnE2+lvOlHVTjvbPjruhSoyjsaO+lSvO4kIa8KVRub4WYuD8rZTj3jiNvqmeooPj8O6AbcVBRwtmeU4besvgZZT9OkVAyVnbB7zGKMmpc6Exa4,iv:7tQfuZoJozW6YGPn2a18SPkjJiQWWq8p8BAlb9QPjgg=,tag:HjFo0jdah+jUN7VRjtY18A==,type:str]
+sops:
+    lastmodified: "2025-07-30T07:14:09Z"
+    mac: ENC[AES256_GCM,data:BjDp3NfmunpCt04acTA4OwYN58N1ttA1/fdbZMxDOHWmkDdtBZdYpfBY/mAk8b+vlb8FZra6z4kiDvb3QJ+6y1BEAjhBKyqgucupiKrbAeFDqkMORPx72mIyE4s0tSqOXXmp8qhFKID3A9QRisyU09YXEMSg8eypbJZIct7XvzY=,iv:Zem5fbxpykD2g3T0wCvPIHb51ebFQVHYmb1+T67vO7I=,tag:N7/PxxeKsmSYKFP82Nwx1A==,type:str]
+    pgp:
+        - created_at: "2025-07-30T07:14:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA+nT7MSlwYOAAQ/9Fmj3VmIY8siRlQd9v7AqAwQHgcwePB7i/4xfcCI7Eanz
+            BO1urDCjo4rvqDjp1UfDGCb4TOSo9cwAWohvE4cRLBOG+afU4GrVYPGKWdVeBIJk
+            zvoDS47TK9D78W2aISB6wjfZS6erdW3ejSGPwVP5Xf/bxEGPq1984jgTwU9ccKBb
+            l/20uH5gYP7z4gVkddW6ro10zlir/WsTuq8hruf8dNjtyHP0Rq9UohhJWLp2VxzK
+            4MhlW6MUrdasqucqXIxSxQ1dwKpEvzTuHjTT5sl82t7EmrCAhSoBZH1jm/WCLJsv
+            GvfgFNTSaK+6GW61nwoQwQMFcxSB9URsTZfhWkjPhfqydilEds1C1k7eFooRv0p8
+            zm7mOufunKms8U3tUDG4y2BM9OXN1p0AV8nr3snrWjtahlSF72tM7mrZ3dFXO/uK
+            drRTFSdfMi1ZuYiZ9qsjJYugYX9Pc2Axx6bbLaU4ak8+H1N9pFGRy0RovmPpy023
+            RGQiYW/8ez1/Fov5xpSJP8qFH81Aat8FvzYldBmR+XX+9COnbPxP9I982lfE7NUu
+            zzgfA3y0jMrL2uwMvOzpastPrTSqgvkkC3tMZ6vwC8kxN7kmREMEH98FuVexH6cU
+            fwmedKVgZT7H2s3amPfqbjjOA973d2bcEU18IGhPJTCWGTuPBF2Y8SU7xdrXEFfS
+            XgE+0XsPwP6ewh0WkULtPibohtILGx1QpHfa+zxquuFkBeCQTa5CsTMcVEBdfvZG
+            QHt5B9+QvH/IvBLUBfzjEFWdMhecXPZzxJWFz1VGkWAvUJkHvLVHaSDN5BY7/1Y=
+            =pi7R
+            -----END PGP MESSAGE-----
+          fp: A638A6B54530D54E868F9D3238736C662F799E0D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2