diff --git a/hosts/bagel-box/default.nix b/hosts/bagel-box/default.nix
index f8ca29a..201cb88 100644
--- a/hosts/bagel-box/default.nix
+++ b/hosts/bagel-box/default.nix
@@ -37,11 +37,6 @@
 
   bagel.services = {
     postgres.enable = true;
-
-    hydra.enable = true;
-    # Takes 10 builders (0 → 9).
-    hydra.builders = lib.genList (i: "builder-${builtins.toString i}") 10;
-
     ofborg.enable = true;
   };
 
diff --git a/hosts/build-coord/default.nix b/hosts/build-coord/default.nix
index 05c6ec1..3c0ce60 100644
--- a/hosts/build-coord/default.nix
+++ b/hosts/build-coord/default.nix
@@ -7,6 +7,12 @@
 
   bagel.sysadmin.enable = true;
 
+  bagel.services = {
+    hydra.enable = true;
+    # Takes 10 builders (0 → 9).
+    hydra.builders = lib.genList (i: "builder-${builtins.toString i}") 10;
+  };
+
   system.stateVersion = "24.05";
   deployment.targetHost = "build-coord.wob01.infra.forkos.org";
 }
diff --git a/secrets.nix b/secrets.nix
index fb35cad..d3df1bf 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -4,10 +4,10 @@ let
   commonKeys = keys.users.delroth ++ keys.users.raito;
 
   secrets = with keys; {
-    hydra-postgres-key = [ machines.bagel-box ];
-    hydra-s3-credentials = [ machines.bagel-box ];
-    hydra-signing-priv = [ machines.bagel-box ];
-    hydra-ssh-key-priv = [ machines.bagel-box ];
+    hydra-postgres-key = [ machines.build-coord ];
+    hydra-s3-credentials = [ machines.build-coord ];
+    hydra-signing-priv = [ machines.build-coord ];
+    hydra-ssh-key-priv = [ machines.build-coord ];
 
     netbox-environment = [ machines.meta01 ];
     mimir-environment = [ machines.meta01 ];
diff --git a/secrets/hydra-postgres-key.age b/secrets/hydra-postgres-key.age
index c8c98ab..389210c 100644
Binary files a/secrets/hydra-postgres-key.age and b/secrets/hydra-postgres-key.age differ
diff --git a/secrets/hydra-s3-credentials.age b/secrets/hydra-s3-credentials.age
index 8e0b949..17212cc 100644
Binary files a/secrets/hydra-s3-credentials.age and b/secrets/hydra-s3-credentials.age differ
diff --git a/secrets/hydra-signing-priv.age b/secrets/hydra-signing-priv.age
index 959e3aa..9670475 100644
Binary files a/secrets/hydra-signing-priv.age and b/secrets/hydra-signing-priv.age differ
diff --git a/secrets/hydra-ssh-key-priv.age b/secrets/hydra-ssh-key-priv.age
index dcf5908..0953fa9 100644
Binary files a/secrets/hydra-ssh-key-priv.age and b/secrets/hydra-ssh-key-priv.age differ