diff --git a/dot_config/private_fish/config.fish.tmpl b/dot_config/private_fish/config.fish.tmpl
index 7a472d91fbb86e1c80f755da92db20ea4b6bd521..918f682f5d3bb746d50e7e259b05a52ff1e91c44 100644
--- a/dot_config/private_fish/config.fish.tmpl
+++ b/dot_config/private_fish/config.fish.tmpl
@@ -63,6 +63,13 @@ set -x RANGER_LOAD_DEFAULT_RC false
 # Disable dumb Python keyring integration
 set -x PYTHON_KEYRING_BACKEND "keyring.backends.null.Keyring"
 
+# Lots of things rely on this
+mise activate fish | source
+
+# secrets
+set -x FNOX_AGE_KEY (cat ~/.config/fnox/age.txt | grep "AGE-SECRET-KEY")
+mise exec fnox@latest -- fnox activate fish | source
+
 # Secrets (uses helper to respect opx-resolved values)
 function secret -a var val
     set -q $var; or set -gx $var $val
@@ -155,9 +162,6 @@ if status is-interactive
 	# register completions (on-the-fly, non-cached, because the actual command won't be cached anyway
 	complete -c cht -xa '(curl -s cheat.sh/:list)'
 
-    # Lots of things rely on this
-    mise activate fish | source
-
     # Dynamic completions
     starship init fish | source
     atuin init --disable-up-arrow fish | source