diff --git a/config-files/sops-nix/secrets.yaml b/config-files/sops-nix/secrets.yaml
index b0ff4f4..7b85e42 100644
--- a/config-files/sops-nix/secrets.yaml
+++ b/config-files/sops-nix/secrets.yaml
@@ -1,46 +1,46 @@
-ssh_public_keys: $SSH_PUBLIC_KEY
+ssh_public_keys: "${SSH_PUBLIC_KEY}"
 
 docker:
   nextcloud: |
-    DOMAIN_NAME=$DOMAIN_NAME
-    NEXTCLOUD_ENABLE_DRI_DEVICE=$TARGET_GRAPHICS
+    DOMAIN_NAME="${DOMAIN_NAME}"
+    NEXTCLOUD_ENABLE_DRI_DEVICE="${TARGET_GRAPHICS}"
   frigate: |
-    DOMAIN_NAME=$DOMAIN_NAME
-    FRIGATE_MQTT_USER=$HOME_ASSISTANT_MQTT_USER
-    FRIGATE_MQTT_PASSWORD=$HOME_ASSISTANT_MQTT_PASSWORD
+    DOMAIN_NAME="${DOMAIN_NAME}"
+    FRIGATE_MQTT_USER="${HOME_ASSISTANT_MQTT_USER}"
+    FRIGATE_MQTT_PASSWORD="${HOME_ASSISTANT_MQTT_PASSWORD}"
   traefik: |
-    DOMAIN_NAME=$DOMAIN_NAME
-    CF_DNS_API_TOKEN=$CF_DNS_API_TOKEN
+    DOMAIN_NAME="${DOMAIN_NAME}"
+    CF_DNS_API_TOKEN="${CF_DNS_API_TOKEN}"
   hass: |
-    DOMAIN_NAME=$DOMAIN_NAME
-    HOME_ASSISTANT_MQTT_USER=$HOME_ASSISTANT_MQTT_USER
-    HOME_ASSISTANT_MQTT_PASSWORD=$HOME_ASSISTANT_MQTT_PASSWORD
+    DOMAIN_NAME="${DOMAIN_NAME}"
+    HOME_ASSISTANT_MQTT_USER="${HOME_ASSISTANT_MQTT_USER}"
+    HOME_ASSISTANT_MQTT_PASSWORD="${HOME_ASSISTANT_MQTT_PASSWORD}"
   passbolt: |
-    DOMAIN_NAME=$DOMAIN_NAME
+    DOMAIN_NAME="${DOMAIN_NAME}"
     TZ="Europe/Paris"
-    PASSBOLT_MYSQL_DATABASE=$PASSBOLT_MYSQL_DATABASE
-    PASSBOLT_MYSQL_USER=$PASSBOLT_MYSQL_USER
-    PASSBOLT_MYSQL_PASSWORD=$PASSBOLT_MYSQL_PASSWORD
-    SENDER_EMAIL_ADDRESS=$SENDER_EMAIL_ADDRESS
-    SENDER_EMAIL_ADDRESS_PASSWORD=$SENDER_EMAIL_ADDRESS_PASSWORD
-    SENDER_EMAIL_DOMAIN=$SENDER_EMAIL_DOMAIN
-    SENDER_EMAIL_PORT=$SENDER_EMAIL_PORT
-    EMAIL_ADDRESS=$EMAIL_ADDRESS
+    PASSBOLT_MYSQL_DATABASE="${PASSBOLT_MYSQL_DATABASE}"
+    PASSBOLT_MYSQL_USER="${PASSBOLT_MYSQL_USER}"
+    PASSBOLT_MYSQL_PASSWORD="${PASSBOLT_MYSQL_PASSWORD}"
+    SENDER_EMAIL_ADDRESS="${SENDER_EMAIL_ADDRESS}"
+    SENDER_EMAIL_ADDRESS_PASSWORD="${SENDER_EMAIL_ADDRESS_PASSWORD}"
+    SENDER_EMAIL_DOMAIN="${SENDER_EMAIL_DOMAIN}"
+    SENDER_EMAIL_PORT="${SENDER_EMAIL_PORT}"
+    EMAIL_ADDRESS="${EMAIL_ADDRESS}"
   pihole: |
-    DOMAIN_NAME=$DOMAIN_NAME
+    DOMAIN_NAME="${DOMAIN_NAME}"
     TZ="Europe/Paris"
-    HOME_ROUTER_SUBNET=$HOME_ROUTER_SUBNET
-    HOME_ROUTER_IP=$HOME_ROUTER_IP
-    HOME_SERVER_IP=$HOME_SERVER_IP
-    FTLCONF_webserver_api_password=$FTLCONF_WEBSERVER_PASSWORD
+    HOME_ROUTER_SUBNET="${HOME_ROUTER_SUBNET}"
+    HOME_ROUTER_IP="${HOME_ROUTER_IP}"
+    HOME_SERVER_IP="${HOME_SERVER_IP}"
+    FTLCONF_webserver_api_password="${FTLCONF_WEBSERVER_PASSWORD}"
 
 disks:
-  data_disk_1: $DATA_DISK_1
-  data_disk_2: $DATA_DISK_2
-  data_disk_3: $DATA_DISK_3
-  data_disk_4: $DATA_DISK_4
-  data_disk_5: $DATA_DISK_5
-  data_disk_6: $DATA_DISK_6
-  parity_disk_1: $PARITY_DISK_1
-  parity_disk_2: $PARITY_DISK_2
-  parity_disk_3: $PARITY_DISK_3
+  data_disk_1: "${DATA_DISK_1}"
+  data_disk_2: "${DATA_DISK_2}"
+  data_disk_3: "${DATA_DISK_3}"
+  data_disk_4: "${DATA_DISK_4}"
+  data_disk_5: "${DATA_DISK_5}"
+  data_disk_6: "${DATA_DISK_6}"
+  parity_disk_1: "${PARITY_DISK_1}"
+  parity_disk_2: "${PARITY_DISK_2}"
+  parity_disk_3: "${PARITY_DISK_3}"