diff --git a/common/wifi.nix b/common/wifi.nix
index 2decc8e..2758d4e 100644
--- a/common/wifi.nix
+++ b/common/wifi.nix
@@ -1,18 +1,15 @@
 { config, lib, ... }:
 {
-  # WiFi configuration for NixOS hosts
-  # Import this module on hosts that should connect to WiFi
-  # Credentials stored in secrets/wifi.yaml (access controlled via .sops.yaml)
-
   sops.secrets.wifi-password-pi = {
     sopsFile = ./../secrets/wifi.yaml;
   };
 
   networking.wireless = {
     enable = true;
+    secretsFile = config.sops.secrets.wifi-password-pi.path;
     networks = {
       "pi" = {
-        pskRaw = "ext:wifi-password-pi";
+        pskRaw = "ext:pi";
       };
     };
     # Only enable on wireless interface, not ethernet
diff --git a/secrets/wifi.yaml b/secrets/wifi.yaml
index 480ac55..f38387e 100644
--- a/secrets/wifi.yaml
+++ b/secrets/wifi.yaml
@@ -1,4 +1,4 @@
-wifi-password-pi: ENC[AES256_GCM,data:uNL8QJxy0tvV2g==,iv:AQyc9j0UpdFnuDFRWEHcIAh0VB4/F8K9YV710ZXynAE=,tag:DmNYDI/2rJ+LQCDcROyqdg==,type:str]
+wifi-password-pi: ENC[AES256_GCM,data:n5ZfyhBCrHx98uUxFQ==,iv:9SQHcIw252GeS0IxON3ThqOk02Wtlfu/Df6KMLAmokw=,tag:F5pAHlInkqVUQDg8MPnMgQ==,type:str]
 sops:
     age:
         - recipient: age1df9ukkmg9yn9cjeheq9m6wspa420su8qarmq570rdvf2de3rl38saqauwn
@@ -19,7 +19,7 @@ sops:
             aUs0dTB3Y3RXTlBCOCtYSHdOMUYxdTgKQShxsJ+3EQU18uixmM3FlCe5C9Rl3oS5
             gwZIrh0amSzX3f9SOjf42h1d+IDL/DMWAlSA/3XMx8TK9A1zKZDgVA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-28T17:05:45Z"
-    mac: ENC[AES256_GCM,data:iND5pd6isGy+zhmcgQQD+n9MiNS5xOfqnijpyXtZP/bXyEzzAZ3SvIkPiNvyLbuXCY99AH+AOOvPmQJtGs6RfBtH1qyD/1oiiJLX4Y06BCtI1Vuyrn21S3fYMrlx6aYEIQsKjo7DEo2v1VENSKF+WmrhxngtdmQJxpuFj09oKSM=,iv:dOJuTX0WSW1IcwBGUbIHsBkNMDl7Okw+K37LZQnFbbU=,tag:xX1/+gpIosTV8ChPVbFi2w==,type:str]
+    lastmodified: "2025-10-29T14:55:56Z"
+    mac: ENC[AES256_GCM,data:2zTEzx8UxOMHIytiufCHS/B1ci7kI05+SIE8ziMY8/ItoAYtt0zXXEgRWs0NLVb3P2vXMOhnXG4qO1o20UXt6Wqq9j1zXPVaQTQie4QSPDdX/8OXXi87Ggm3WQyeA1IfABacfL0D6XkNvxfMHGvMrnhYltPPgYDuNlgjnnjTm8o=,iv:FJMKLSlAenvSNUH6OmeGIR7f9Bzl3NwqaUaokoHEj50=,tag:WU4BnlLu5cKSbtiYL0mNKg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0