diff --git a/nixos/system/packages/sops/secrets/secrets.yaml b/nixos/system/packages/sops/secrets/secrets.yaml
index 220f7de..ed4e6cb 100644
--- a/nixos/system/packages/sops/secrets/secrets.yaml
+++ b/nixos/system/packages/sops/secrets/secrets.yaml
@@ -5,6 +5,9 @@ ginoza:
     password-hash: ENC[AES256_GCM,data:xqE0y3Z7+kasYFQLn4Wuo+/c9L8BEakf2HKgN5BsttC2iDuzYSvXrP8K6pe5Skdi5Aq0MVz9LixJFM3PBgLORL1C6k0iDSardw==,iv:bKL40h0rGNmnnkA7EieKAD5KyENXOiTNsTVH1V0B7HU=,tag:c1MsRuiOK/j2b0iKOyO8FQ==,type:str]
 longinus_spear: ENC[AES256_GCM,data:MMXTgboz4yY=,iv:OCav/ZmFCKLTJ9YWAbu4692E4d/gc6T0yTs0viZFdSs=,tag:YW6WFG39eDwxkd+6xXwH/Q==,type:str]
 cassius_spear: ENC[AES256_GCM,data:AwWRQOPlLoE=,iv:DACo6Xrr/3ZPMhR9Oq4bxvU02FF0k9z8WVZdqfqaD8Y=,tag:mVK1OB8I0M1Uq00QV7hyVQ==,type:str]
+wakapi:
+    salt: ENC[AES256_GCM,data:rE/uqqWog1XoSAq+,iv:mLfjliXChj57nGbPAGhTwv5HG07npZzDCgka84Vubrk=,tag:uVMQwzTHnYh5pbua0K9SKA==,type:str]
+    api_key: ENC[AES256_GCM,data:Haaw84nHmBK2+/A7y0wp0AnZi342LYUvOaWMDQ2TRn1VkbYg,iv:Lnxeu0MTmyPFTm+WM9kwScdMmqplU3wBSRF+EoNa2Zk=,tag:WYvGQfT4FkcYL3piKiHidA==,type:str]
 ssh_keys:
     masaoka_private: ENC[AES256_GCM,data:3xiESl2Lc9EEsTCnr9K+CUMPgpQgnH0LC/wTInuLDrsRXuBXTHUzIZT1P8DwZ520M5NeGO0qDkiF4gH9rwm2Jzp3KKR7S1aruS51mouQUnr3e965RI9jeCdogQYkXMbpGVDk0eWApUx/iQz/hKWvaCRMBWOnnsTKRgDRRBNry8MJAFlypBbpr5aGnkJYzVCRH+c8b1tY8HYuZJtQpbeI5PK3YMhyD9AiUcl3j4LduY/GGcsX1so6EeNeYwzEWG7Qh9dEO2iFGwYhqtlPs3HgY9UrKUrFht6aDP+g6uzuK2Sg5iuKgygPviN0pbFcyKUWzqpecoOaMMFuf9GpDsqtDaE+I1c8XP4Fa4Nmql5P/0LVu2ozZwvUt179oo+8GboQunr0XdLSErUZwFMZ2uAaG5ej/5xaCLmaoM9Ukj804+6LWZ6ty595LmJhYREn1C8Dvka2IBEQk7pWfC3Y0eOFfUPqcsRG6VX1Aw0a7PSPaTCK7ZBLOqaNRihn1/AZd/4yGWmh+8eHoxh+/5mMXcv3nUS/nzxUDt6AxBhJP3LXbY+XDpWU+qdlF3sibcpfwzFcffO4g6ehQ6Jsbd7kbt5CefCp2uUamHvNHXSV41s1DCPtcKzKZ+RItPLa+6GM7KvqB0GN3G56MaiTbKtXzwUPzSzZHnKK2gN3GWd9VDTWQrMlh1Zre0PhdmYtjrvBGXDcmhfftowkzZZCT3Ml76356gjszs331ddXJ9v3gRh/TX2Q,iv:8Ls+tDol+PeNCJP+sy4qwTIDFMZJA9dF4x31pygUIXk=,tag:rGqgoyYu+Nd4d3KQ8XnlfA==,type:str]
     masaoka_public: ENC[AES256_GCM,data:g6L2wZth2SaKDrD8hKlVkVWJa6WFi0XE2ra+9HF2uhTH1llCYmLab5CEhDsjTHyh65U4IAfsrYrMwlJH2iQXn/L6SLQmR00pn6qYfQ6sURCwZvSxKoJuHTuTNv7AH8J5Nxq/u6SMjYGVKhw/6ewHEOygVs0/a+rDFcn4x2WXPgRGKLa1CEyncfvslyYL,iv:dNDGDU0ZUuRDzcUTWh4SGnbfzuRUoDL4i1j/mLwQ1Gc=,tag:E8yzoyBee3uAgit9aoOeLA==,type:str]
@@ -23,8 +26,8 @@ sops:
             T0cxV21SN0hJaFg3R3hpTjIxa3lJNVEKdIrR5XDHxpCojk2A1pxc4dYtSJRrObbY
             JS/nDgu74LugEchiOhuIJ7nh3MS5XBOmmt2GTHrqxZEZFoIykjIGug==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-19T15:03:13Z"
-    mac: ENC[AES256_GCM,data:JfzYwtQJE7jq9QE79EJDYnN69vEe5WJcPVbKto0a2no1bHIDxSBJpIgczO/fah6AqYeREZe+NiQUpnc110T9iZRQ3ouhKvlcxbov3nHkjTiVYSN1pP+5V0yeYKZ4W+ivRGpfchvgK4Oo8B8NKy+0oTHhY2C4Ms0h6uUeQsVikfo=,iv:YVrQNatL8G6MS0QeOVuD3zaUQp9C/Ju1i1C6+oCxXOc=,tag:zApfKtOdIUdr9HYU9Nk6RQ==,type:str]
+    lastmodified: "2025-02-25T20:03:32Z"
+    mac: ENC[AES256_GCM,data:9X7kF+18TGfsfI6S4Mwm8BzCnnksZpUK9L2dJmT3FUdOd+BhyuqUPTh+xxyhICRk1+Hle4NoeXSQEteoaZtRyCVN/JQ0qJbsUscG5xOHIe8XN+ypd53cSZETyeXK27/mRH46C1Ww2N+WsfkPRu6iEWAI5IWS66ZC0fJlqcTcr/A=,iv:/Je8+kjNzBZfPcws5UlkL5Th2pA3ftJveV7Q+fHMAaw=,tag:e+rE2tLZXSX90F6xY/VvLA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4
diff --git a/nixos/system/packages/sops/sops.nix b/nixos/system/packages/sops/sops.nix
index ef09a39..64f32e7 100644
--- a/nixos/system/packages/sops/sops.nix
+++ b/nixos/system/packages/sops/sops.nix
@@ -18,30 +18,35 @@
 
       # SSH private keys
       secrets = {
+        "${userSettings.hostname}/password-hash" = {
+          neededForUsers = true;
+        };
+
+         "longinus_spear" = {
+          owner = userSettings.username;
+          group = "users";
+        };
+
+        "cassius_spear" = {
+          owner = userSettings.username;
+          group = "users";
+        };
+
         "ssh_keys/masaoka_private" = {
           path = "/home/${userSettings.username}/.ssh/id_masaoka";
           owner = userSettings.username;
           group = "users";
         };
 
-        "${userSettings.hostname}/password-hash" = {
-          neededForUsers = true;
+        "wakapi/salt" = {
+          owner = userSettings.username;
+          group = "users";
         };
 
         "${userSettings.hostname}/syncthing" = {
           owner = userSettings.username;
           group = "users";
         };
-
-        "longinus_spear" = {
-          owner = userSettings.username;
-          group = "users";
-        };
-
-        "cassius_spear" = {
-          owner = userSettings.username;
-          group = "users";
-        };
       };
 
       templates = {
@@ -68,5 +73,7 @@
 
     # Syncthing password
     #services.syncthing.settings.gui.password = config.sops.templates."syncthing-password".content;
+
+    services.wakapi.passwordSaltFile = "${config.sops.secrets."wakapi/salt".path}";
   };
 }
diff --git a/nixos/system/packages/yubikey.nix b/nixos/system/packages/yubikey.nix
index afab288..f435e19 100644
--- a/nixos/system/packages/yubikey.nix
+++ b/nixos/system/packages/yubikey.nix
@@ -30,7 +30,7 @@
         enable = true;
         debug = false;
         mode = "challenge-response";
-        control = "sufficient";
+        control = "required";
         #! id = [ "1234567890" ];
         #! YubiKey ID is stored in SOPS
         #! and is set in the module configuration