diff --git a/secrets/drone.env b/secrets/drone.env
new file mode 100644
index 0000000..b8d26e3
Binary files /dev/null and b/secrets/drone.env differ
diff --git a/services/drone/drone.env b/services/drone/drone.env
index 3744b8a..5779873 100644
--- a/services/drone/drone.env
+++ b/services/drone/drone.env
@@ -1,3 +1,2 @@
-DRONE_RPC_SECRET=c9abde046b241975770a775fca86e4c9
 DRONE_SERVER_HOST=drone.${DOMAIN}
 DRONE_RPC_HOST=${DRONE_SERVER_HOST}
\ No newline at end of file
diff --git a/services/drone/drone.yml b/services/drone/drone.yml
index 7a6b519..ea87927 100644
--- a/services/drone/drone.yml
+++ b/services/drone/drone.yml
@@ -10,9 +10,12 @@ services:
       - ${DOCKER_STORAGE_PATH}/drone:/data
     env_file:
       - drone.env
+      - ../../secrets/drone.env
     environment:
-      - DRONE_GITEA_CLIENT_ID=0d11d359-a420-4a66-a04c-0a136448b7e7
-      - DRONE_GITEA_CLIENT_SECRET=Qx0LqE0Qb-M3MZAiojtlILRY3nfNzOiUUTdOCpW7Feo=
+      # encrypted
+      # - DRONE_GITEA_CLIENT_ID=
+      # - DRONE_GITEA_CLIENT_SECRET=
+      # - DRONE_RPC_SECRET=
       - DRONE_GITEA_SERVER=https://git.${DOMAIN}
       - DRONE_SERVER_PROTO=https
       - DRONE_USER_CREATE=username:lukas,admin:true
@@ -30,7 +33,10 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
     env_file:
       - drone.env
+      - ../../secrets/drone.env
     environment:
+      # encrypted
+      # - DRONE_RPC_SECRET=
       - DRONE_RPC_PROTO=https
       - DRONE_RUNNER_CAPACITY=1
       - DRONE_RUNNER_NAME=nas-docker-runner