diff --git a/modules/private/ssh-hosts.nix b/modules/private/ssh-hosts.nix
deleted file mode 100644
index 30a6374..0000000
--- a/modules/private/ssh-hosts.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ ... }:
-{
-  # Stub. Real values kept locally via:
-  #   git update-index --skip-worktree modules/private/ssh-hosts.nix
-  programs.ssh.extraConfig = "";
-}
diff --git a/modules/programs.nix b/modules/programs.nix
index 93876e8..1bde50a 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -2,7 +2,15 @@
 { config, pkgs, lib, ... }:
 
 {
-  imports = [ ./private/ssh-hosts.nix ];
+  # Private SSH host aliases live in sops (secrets/network.yaml: ssh-hosts)
+  sops.secrets."ssh-hosts" = {
+    sopsFile = "/etc/nixos/secrets/network.yaml";
+    key = "ssh-hosts";
+    mode = "0444";
+  };
+  programs.ssh.extraConfig = ''
+    Include /run/secrets/ssh-hosts
+  '';
 
   # GPG agent
   programs.gnupg.agent = {