diff --git a/secrets/mcp.yaml b/secrets/mcp.yaml
index 8f8d7f5..6df85f8 100644
--- a/secrets/mcp.yaml
+++ b/secrets/mcp.yaml
@@ -27,10 +27,11 @@ tandoor:
     secret_key: ENC[AES256_GCM,data:nl7S2fS1wENrT5k2iZfLEAGc99lCUktgwR5L5KklF69BNVKQkW1rUgb3aIv50VpXZa+3OxV/vdPmG9NhKMy96I5+Dno=,iv:FFyGQBARz0B5zrONZELzUMsOIn8TWrDNTKGsAHPlS7w=,tag:/c4MnDfLXQpBZDqVxZ0DTg==,type:str]
 immich:
     database: ENC[AES256_GCM,data:1fjOQsLZcq/T+r+AkzomWwCQWw==,iv:c4pn2rC+3xkxLJ7uAdhnTE6zVTRQkfuKK3tjUyDhfAw=,tag:kvk7DOv6X/+RDxfPxVak7w==,type:str]
+searxng:
+    secret: ENC[AES256_GCM,data:Dg/6TAKY7fyhw8LJ6E4ZYN85zs/ItcetCYHETFbOMvHkGsflE3ngQNyIPVY=,iv:z3y2vXjJWCGhXYjfj963Nhiw6K0i/M8bVvwO/L3zgzk=,tag:yO9NtYMLjSazHQmToSR3fA==,type:str]
 sops:
     age:
-        - recipient: age1dstsz5g4qthwt2sssu5wp787ku7rnfqm02mqaefsaueswhvqzpmsyft4p4
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZnYrVnR1MlBjdzFpQnVi
             RXFUcEN2N0Zoc2ZUUnprdXc0aElFaXU5c1VBCkxxcGd4QUhOaTl4K0paOTZ3d2Ez
@@ -38,8 +39,8 @@ sops:
             b2NVRnVFNmF6a2hjRE9OOUxVMGpjSWcKA6Do+oddwMjc2XNJUCeGXY985gJZ4f2v
             Dyo0/Oyuwz1jFMrjLmnmnmtyn079mT9wsm28KlaEEvzDIxOBnLjx6A==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yvdzvuvu5wqztcx6ll2xk6x547uuyqy735tjjdd7zftkz53jsf9qf5ahue
-          enc: |
+          recipient: age1dstsz5g4qthwt2sssu5wp787ku7rnfqm02mqaefsaueswhvqzpmsyft4p4
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeGhvQWp6WWx6N1JDdm1J
             UWlWZTV5ellMd2ZIRWpkRnJDT2s4UVZJMEM4Cll2MnVNTnFWYit2bHpCVzcwbysy
@@ -47,8 +48,8 @@ sops:
             OHlxaytJTWlNSFRCd2dDaFVsUU1CbUkKp7J+mDnGFS9upV6QWi40ptG85+UZ5y1G
             9ic/sQEMHQe9VeAutVz1GPYWbF3Vt5iawXmtVxN+zx/bLAYGglv5yg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jrk4h7x4qzhr6z5m4d099mlfyjc4n5n9s52r4gfsdz0slnqlqa9sss735v
-          enc: |
+          recipient: age1yvdzvuvu5wqztcx6ll2xk6x547uuyqy735tjjdd7zftkz53jsf9qf5ahue
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkM0RRaFhGKytkSjNMU3cy
             d1dlcms4TVMzU2xsSHBqcDJWQTdCU1dZcERJCktHRVZiWkZrbzk4QXRNSmpyY25X
@@ -56,7 +57,8 @@ sops:
             QlE3cFYxUXNVam1aMlJEVTRGV2xsN1kKXMeSXiEdXyb6c+dcxX3G/Q+s78lfi90g
             dvKJPDYvGb/8JXSkZNkLlWvHEVnsAJ1mJFb1idenYzeQvJlsX07rYA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-25T00:28:13Z"
-    mac: ENC[AES256_GCM,data:hDmqObrtfoVkQqz8JPkqlyXMbiuyBophjdZNLvTFrZw3pAVNCuzsH4zxFBOaxJttkzLc65DWDHDeEIBY5YZam1GLFFXUQ5E3Dxno7hnyzOoM2ipgDTOacI0gbKJAWgGUF3LNDdqVoREA9LC91LoNUJoNmzpTSFtuLb7ORuwCrH4=,iv:8+W3n1Cr6woEiPU9ECaMYM64HNmFHr2AIw6UohCJi00=,tag:7drkZiPAUHaEx5PagXA9JQ==,type:str]
+          recipient: age1jrk4h7x4qzhr6z5m4d099mlfyjc4n5n9s52r4gfsdz0slnqlqa9sss735v
+    lastmodified: "2026-07-21T02:59:55Z"
+    mac: ENC[AES256_GCM,data:0v26ceptPmbVdee70AOMdZHOarPDRuxKi+QP3Ci+wyJQJdQVriKKUnN3Zv/MKjZ3Sg2M/C5XtsdhGwXJpPsfwdDhWIRip6UYWXIKkVyZcxOs6E2zlK3xCAk/eTKhAsmL7Y6yFV+hpYwlT/hFnzOHXt1xbxGVJiKnO98OH0+6hnk=,iv:f94wd227bM0SniUuY+CFg2deEfITzUGTGwDA/WQJhms=,tag:M0r4Vg480wWWYPH3PBB7qg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.1
diff --git a/system/hosts/mcp/containers/searxng.nix b/system/hosts/mcp/containers/searxng.nix
index 3f959e0..ba1fb01 100644
--- a/system/hosts/mcp/containers/searxng.nix
+++ b/system/hosts/mcp/containers/searxng.nix
@@ -1,10 +1,24 @@
-
 { config, ... }:
-let inherit (import ./lib.nix config) havenisms mkContainer; in
+let
+  inherit (import ./lib.nix config) havenisms mkContainer;
+in
 {
+  sops = {
+    secrets = {
+      "searxng/secret" = { };
+    };
+    templates."searxng.env" = {
+      mode = "0400";
+      content = ''
+        SEARXNG_BASE_URL=https://search.${havenisms}
+        SEARXNG_VALKEY_URL=valkey://valkey:6379/0
+        SEARXNG_SECRET=${config.sops.placeholder."searxng/secret"}
+      '';
+    };
+  };
   virtualisation.oci-containers.containers.searxng = mkContainer {
     hostName = "search";
-    image = "docker.io/searxng/searxng:latest";
+    image = "searxng/searxng:latest";
     port = 8080;
     public = true;
     dependsOn = [
@@ -19,9 +33,9 @@ let inherit (import ./lib.nix config) havenisms mkContainer; in
     volumes = [
       "/tank/config/searxng:/etc/searxng"
     ];
-    environment = {
-      SEARXNG_BASE_URL = "https://search.${havenisms}";
-      SEARXNG_REDIS_URL = "redis://valkey:6379/0";
-    };
+    environmentFiles = [
+      config.sops.templates."searxng.env".path
+    ];
+    extraOptions = [ "--pull=always" ];
   };
 }