diff --git a/ops/machines/gerrit01/default.nix b/ops/machines/gerrit01/default.nix
index a895316a8..3b5e02905 100644
--- a/ops/machines/gerrit01/default.nix
+++ b/ops/machines/gerrit01/default.nix
@@ -54,6 +54,7 @@ in
       secretFile = name: depot.ops.secrets."${name}.age";
     in
     {
+      buildkite-api-proxy-token.file = secretFile "buildkite-api-proxy-token";
       gerrit-oauth-secret.file = secretFile "gerrit-oauth-secret";
       gerrit-replication-key.file = secretFile "gerrit-replication-key";
       gerrit-sendemail-smtp-pass.file = secretFile "gerrit-sendemail-smtp-pass";
diff --git a/ops/secrets/buildkite-api-proxy-token.age b/ops/secrets/buildkite-api-proxy-token.age
new file mode 100644
index 000000000..1c2e16522
Binary files /dev/null and b/ops/secrets/buildkite-api-proxy-token.age differ
diff --git a/ops/secrets/secrets.nix b/ops/secrets/secrets.nix
index f01267c43..360f0a9a9 100644
--- a/ops/secrets/secrets.nix
+++ b/ops/secrets/secrets.nix
@@ -35,6 +35,8 @@ in
   "restic-bucket-credentials.age" = allDefault;
 
   "keycloak-db-password.age" = public01Default;
+
+  "buildkite-api-proxy-token.age" = gerrit01Default;
   "gerrit-oauth-secret.age" = gerrit01Default;
   "gerrit-replication-key.age" = gerrit01Default;
   "gerrit-sendemail-smtp-pass.age" = gerrit01Default;