diff --git a/secrets.nix b/secrets.nix
index 24c992a..e4b3446 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -11,6 +11,7 @@ let
     mimir-environment = [ machines.meta01 ];
     grafana-oauth-secret = [ machines.meta01 ];
     loki-environment = [ machines.meta01 ];
+    gerrit-prometheus-bearer-token = [ machines.gerrit01 machines.meta01 ];
 
     # These are the same password, but nginx wants it in htpasswd format
     metrics-push-htpasswd = [ machines.meta01 ];
diff --git a/secrets/gerrit-prometheus-bearer-token.age b/secrets/gerrit-prometheus-bearer-token.age
new file mode 100644
index 0000000..425573e
--- /dev/null
+++ b/secrets/gerrit-prometheus-bearer-token.age
@@ -0,0 +1,22 @@
+age-encryption.org/v1
+-> ssh-ed25519 2D+APA Vh/FrR9oyO8V1pEMQkmGbHCePB6RU+dPm+Z4bgKenEg
+2G5eLlYe8IS7fsEBorFljUwQZ9sEk/FEr25S4p5hWLk
+-> ssh-ed25519 j2r2qQ 9+NX0Guhux9QlAxx2MtSZH0OZpDk1CQZ4Blu1P9fpgQ
+PDUoAjBaIdKQAvRblvc0QEtrvp5MpE8HsCwKWwAn0uE
+-> ssh-ed25519 K3b7BA wuOc6LGnjsC4Rb9D9QX3YVgMqWPvBK27Q0vqADLpsk8
+wRnoNzkyaU9SGlOtpqY2pAeIwD9lGWKrqNn3D3W7U6Y
+-> ssh-ed25519 +qVung biXtZHmjJmsazEmp1iIGUqmuV1YP94bzrMjoZTmGPjg
+GDN4WZGTIP6b2nmjyhikHeOrZi9YEtiPOyaJLzUl138
+-> ssh-rsa krWCLQ
+UkNySvhS5o6v6/7xGvn43hgD5y2D91oH4pjU3Oa83CW6ha80dnE+JkSTpTdz7Og0
+vtZJuisNpcH254zTt8OAUpWN/tVXlD34RyV1xo1eHEWgUzKactrhlACpSbzYBdVJ
+8cUj7jiE+qjIOtrU2sHWo09NKpf0J2YEPwajuBy1/fPrivlgXAzdAAnP4gll02x1
+Et8lUn6HVfYDGtrDo/PUUdgcGudVeCOJbvvrKYkuqe8vsNYgnFHM8dkTJmObL8dz
+zp4MEuIQ3WrrXActSnTs+QAGIFSskOIr1DQlJRYzQcYtd8wkfx9a+6oxBECZyDAZ
+T4yso7ctflKlr6OqpJYzeA
+-> ssh-ed25519 /vwQcQ +jsCn0OlVpuyVA0XSvD3ZCDRTBq29UV9qsDvE4XaGk0
+p2qblImpl+G0pefJ0T/GjanIc7+bNuA0wRB4mUuFGXM
+-> ssh-ed25519 0R97PA /bE6+eVlzeJKOOMqz4QjFdsu+5XDv9L8cZ94cPZ5WQk
+Xco24ijeQnaT7jcsfXLQPzGr1FE/zy9+qVoQ20DLP+Q
+--- NDqgX11cTXR48vD9YmAIYx+og0n1OQj+bbkKwqv2BeE
+��\�w�
��9̒7�cؚ���%}|k�?��$9�l�&�=�v��ܹ!P��3b���퀩
\ No newline at end of file