diff --git a/.gitignore b/.gitignore
index 92ed17b..9bccbe1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,14 @@
+# build logs and artifacts
+result
+*.iso
 *.txt
 *.log
 *.swp
 .build/
 .logs/
+
+# secrets
+*.key
+*.priv
+.idx/dev.local.nix
+*.decrypted
diff --git a/shared/agenix.nix b/shared/agenix.nix
index 9c74f26..b76c822 100644
--- a/shared/agenix.nix
+++ b/shared/agenix.nix
@@ -20,11 +20,11 @@ let
   hackclub_yk = pubkeys.fido2Keys.hackclub_yubikey;
 in
 {
-  options = import ./options/agenix.nix;
   config = {
     imports = [
       agenix.nixosModules.default
       agenix-rekey.nixosModules.default
+      ./options/agenix.nix
     ];
 
     age.rekey = lib.mkIf cfg.enable {
diff --git a/shared/gnupg.nix b/shared/gnupg.nix
index f64de0f..908344c 100644
--- a/shared/gnupg.nix
+++ b/shared/gnupg.nix
@@ -9,7 +9,7 @@ let
   cfg = config.nixops-config.secretOps.gnupg;
 in
 {
-  options = import ./options/gnupg.nix;
+  imports = [ ./options/gnupg.nix ];
   config = lib.mkIf cfg.enable {
     programs.gnupg.agent = {
       enable = true;