diff --git a/flake.nix b/flake.nix
index 87bc70d..0d4a557 100644
--- a/flake.nix
+++ b/flake.nix
@@ -46,6 +46,15 @@
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # agenix: age-encrypted secrets, decrypted at activation with each host's
+    # SSH host key. Provides the SSSD LDAP bind credential (secrets/, see
+    # modules/sssd.nix). The darwin module is intentionally unused (SSSD is
+    # Linux-only).
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
     # Declarative Neovim (the editor; see home/editor.nix). Release
     # branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
     # single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
@@ -123,7 +132,9 @@
           ./modules/users.nix
           ./modules/common-nixos.nix
           ./modules/features.nix
+          ./modules/sssd.nix
           commonModule
+          inputs.agenix.nixosModules.default
           home-manager.nixosModules.home-manager
           {
             home-manager.useGlobalPkgs = true;