diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 67454d1f7..978939f69 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -3,6 +3,14 @@ with import <stockholm/lib>;
   cfg = config.krebs.secret;
 in {
   options.krebs.secret = {
+    directory = mkOption {
+      default = toString <secrets>;
+      type = types.absolute-pathname;
+    };
+    file = mkOption {
+      default = relpath: "${cfg.directory}/${relpath}";
+      readOnly = true;
+    };
     files = mkOption {
       type = with types; attrsOf secret-file;
       default = {};