diff --git a/.sops.yaml b/.sops.yaml
index e7ba0d8..34b8e9e 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,10 +5,12 @@
 #            /srv/cc-ci/.sops/master-age.txt (never in this repo). Lets us re-key if cc-ci is lost.
 keys:
   - &host   age1h90utdztfc23kx8ewrtrtk80mnddvrf8pg4ppej55rwwwupzhfvqhmp3qa
+  - &host2  age1tmvgpgc822ezqgxg4x8h6ndph6j9hwpgjpg364zn7lw3t5h694rq5730wa
   - &master age1cmk26t9e30ls8594s8txgmf2exenydmntfxqpcd3qdqm3ru2lpnqpdkdz9
 creation_rules:
   - path_regex: secrets/.*\.(yaml|json|env)$
     key_groups:
       - age:
           - *host
+          - *host2
           - *master
diff --git a/secrets b/secrets
index 2ce5f86..638c28d 160000
--- a/secrets
+++ b/secrets
@@ -1 +1 @@
-Subproject commit 2ce5f86c0216cc0e4fdb5b2ec1248b34165066cd
+Subproject commit 638c28dae8f01f0549209a4b7a4f1c4e5963ac1f