diff --git a/configs/cloud.nix b/configs/cloud.nix
index 11aac2e..a39bfa8 100644
--- a/configs/cloud.nix
+++ b/configs/cloud.nix
@@ -34,8 +34,8 @@
   krebs.syncthing = rec {
     enable = true;
     id = config.networking.hostName;
-    key = toString <secrets/syncthing-key.pem>;
-    cert = toString <secrets/syncthing-cert.pem>;
+    key = toString <secrets/syncthing/key.pem>;
+    cert = toString <secrets/syncthing/cert.pem>;
     peers = {
       homeros.id = "HSOL72W-MMN346W-C3WCWCH-OTRKJYG-MY2WWV6-P7JUHN7-5WYYYRV-ZMH4KAA";
       scardanelli.id = "7CZYHEX-3CSFDQU-PEEMYHG-6XGQ2ZD-KGVUWH5-GFRB2XK-FP57ERX-7APZUQU";
diff --git a/deploy.nix b/deploy.nix
index d127e38..db61cb6 100644
--- a/deploy.nix
+++ b/deploy.nix
@@ -43,7 +43,7 @@ let
       ref = "1340e3fb";
     };
     secrets.pass = {
-      dir = toString ~/.password-store;
+      dir = toString ~/.password-store/niveum/systems;
       inherit name;
     };
     art.file = toString ./art;
diff --git a/systems/catullus/configuration.nix b/systems/catullus/configuration.nix
index 53f7558..083d5ee 100644
--- a/systems/catullus/configuration.nix
+++ b/systems/catullus/configuration.nix
@@ -149,7 +149,7 @@ in {
   };
 
   environment.etc."tinc/retiolum/rsa_key.priv" = {
-    text = builtins.readFile <secrets/retiolum.rsa_key.priv>;
+    text = builtins.readFile <secrets/retiolum.key>;
     mode = "400";
   };
 }
diff --git a/systems/catullus/containers.nix b/systems/catullus/containers.nix
index ddb9cf0..13e377c 100644
--- a/systems/catullus/containers.nix
+++ b/systems/catullus/containers.nix
@@ -25,7 +25,7 @@ in {
   niveum.telegramBots.quotebot = {
     enable = true;
     time = "08/6:00";
-    token = lib.strings.removeSuffix "\n" (builtins.readFile <secrets/telegram-kmein.token>);
+    token = lib.strings.removeSuffix "\n" (builtins.readFile <secrets/telegram/kmein.token>);
     chatIds = [ "18980945" "757821027" ];
     command = "${pkgs.literature-quote}/bin/literature-quote";
     parseMode = "Markdown";
@@ -34,7 +34,7 @@ in {
   niveum.telegramBots.autorenkalender = {
     enable = true;
     time = "07:00";
-    token = lib.strings.removeSuffix "\n" (builtins.readFile <secrets/telegram-kmein.token>);
+    token = lib.strings.removeSuffix "\n" (builtins.readFile <secrets/telegram/kmein.token>);
     chatIds = [ "@autorenkalender" ];
     command = "${pkgs.autorenkalender}/bin/autorenkalender";
   };
@@ -42,7 +42,7 @@ in {
   systemd.services.telegram-odyssey = {
     wantedBy = [ "multi-user.target" ];
     description = "Telegram bot reciting the Odyssey to you";
-    environment.TELEGRAM_ODYSSEY_TOKEN = builtins.readFile <secrets/telegram-odyssey.token>;
+    environment.TELEGRAM_ODYSSEY_TOKEN = builtins.readFile <secrets/telegram/odyssey.token>;
     enable = true;
     script = ''${pkgs.telegram-odyssey}/bin/telegram-odyssey'';
     serviceConfig.Restart = "always";
@@ -51,7 +51,7 @@ in {
   systemd.services.telegram-reverse = {
     wantedBy = [ "multi-user.target" ];
     description = "Telegram bot for reversing things";
-    environment.TELEGRAM_REVERSE_TOKEN = builtins.readFile <secrets/telegram-reverse.token>;
+    environment.TELEGRAM_REVERSE_TOKEN = builtins.readFile <secrets/telegram/reverse.token>;
     enable = true;
     script = ''${pkgs.telegram-reverse}/bin/telegram-reverse'';
     serviceConfig.Restart = "always";
@@ -60,7 +60,7 @@ in {
   systemd.services.telegram-betacode = {
     wantedBy = [ "multi-user.target" ];
     description = "Telegram bot for converting Ancient Greek betacode into unicode";
-    environment.TELEGRAM_BETACODE_TOKEN = builtins.readFile <secrets/telegram-betacode.token>;
+    environment.TELEGRAM_BETACODE_TOKEN = builtins.readFile <secrets/telegram/betacode.token>;
     enable = true;
     script = ''${pkgs.telegram-betacode}/bin/telegram-betacode'';
     serviceConfig.Restart = "always";
@@ -69,7 +69,7 @@ in {
   systemd.services.telegram-proverb = {
     wantedBy = [ "multi-user.target" ];
     description = "Telegram bot for generating inspiring but useless proverbs";
-    environment.TELEGRAM_PROVERB_TOKEN = builtins.readFile <secrets/telegram-proverb.token>;
+    environment.TELEGRAM_PROVERB_TOKEN = builtins.readFile <secrets/telegram/proverb.token>;
     enable = true;
     script = ''${pkgs.telegram-proverb}/bin/proverb_bot.py'';
     serviceConfig.Restart = "always";