diff --git a/nixos/arion-openclaw/arion-compose.nix b/nixos/arion-openclaw/arion-compose.nix
index 07ccb6c..99189f8 100644
--- a/nixos/arion-openclaw/arion-compose.nix
+++ b/nixos/arion-openclaw/arion-compose.nix
@@ -16,6 +16,7 @@
         environment = {
           OPENCLAW_HOME = "/root/.openclaw";
         };
+        env_file = [ "/run/agenix/openai-api-key" ];
         command = [
           "sh" "-c"
           ''
diff --git a/nixos/linux.nix b/nixos/linux.nix
index 9d42fe1..8bfa761 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -86,6 +86,11 @@ in {
       file = ./secrets/coldairnetworks.age;
       owner = "root";
     };
+
+    openai-api-key = {
+      file = ./secrets/openai-api-key.age;
+      owner = "root";
+    };
   };
 
   environment.systemPackages = [
diff --git a/nixos/secrets/default.nix b/nixos/secrets/default.nix
index 75c83c6..5ce3dfc 100644
--- a/nixos/secrets/default.nix
+++ b/nixos/secrets/default.nix
@@ -34,4 +34,7 @@ in {
   # DATABASE_URL=<supabase postgres dsn>
   # BETTER_AUTH_SECRET=<secret>
   "./coldairnetworks.age".publicKeys = [mainframePublicKey];
+
+  # OPENAI_API_KEY
+  "./openai-api-key.age".publicKeys = [mainframePublicKey];
 }
diff --git a/nixos/secrets/openai-api-key.age b/nixos/secrets/openai-api-key.age
new file mode 100644
index 0000000..39150e3
Binary files /dev/null and b/nixos/secrets/openai-api-key.age differ