diff --git a/cluster/services/cachix-deploy-agent/credentials/grail.age b/cluster/services/cachix-deploy-agent/credentials/grail.age
new file mode 100644
index 0000000..0cbfbef
Binary files /dev/null and b/cluster/services/cachix-deploy-agent/credentials/grail.age differ
diff --git a/cluster/services/cachix-deploy-agent/default.nix b/cluster/services/cachix-deploy-agent/default.nix
index 8610b4f..4f8d537 100644
--- a/cluster/services/cachix-deploy-agent/default.nix
+++ b/cluster/services/cachix-deploy-agent/default.nix
@@ -1,6 +1,6 @@
 {
   services.cachix-deploy-agent = {
-    nodes.agent = [ "checkmate" "prophet" "VEGAS" "thunderskin" ];
+    nodes.agent = [ "checkmate" "grail" "prophet" "VEGAS" "thunderskin" ];
     nixos.agent = ./agent.nix;
   };
 }
diff --git a/secrets.nix b/secrets.nix
index 7658b06..19c937a 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -9,6 +9,7 @@ in with hosts;
   "cluster/services/attic/attic-s3-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/attic/attic-server-token.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/cachix-deploy-agent/credentials/checkmate.age".publicKeys = max ++ map systemKeys [ checkmate ];
+  "cluster/services/cachix-deploy-agent/credentials/grail.age".publicKeys = max ++ map systemKeys [ grail ];
   "cluster/services/cachix-deploy-agent/credentials/prophet.age".publicKeys = max ++ map systemKeys [ prophet ];
   "cluster/services/cachix-deploy-agent/credentials/VEGAS.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/cachix-deploy-agent/credentials/thunderskin.age".publicKeys = max ++ map systemKeys [ thunderskin ];