diff --git a/.gitmodules b/.gitmodules
index 5ddcb85..1bd62cc 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,3 @@
 [submodule "secrets"]
 	path = secrets
-	url = ./secrets
+	url = git@github.com:appaquet/dotfiles-secrets.git
diff --git a/flake.lock b/flake.lock
index 3119029..75ae358 100644
--- a/flake.lock
+++ b/flake.lock
@@ -464,11 +464,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727230442,
-        "narHash": "sha256-YnMPeqQLXDAb+EQzWUnm5HWpnYUs3cqJ/SGYuv17lcs=",
+        "lastModified": 1727444631,
+        "narHash": "sha256-/V4I7ZDeSkEEb9oI32noiktbFsk+TtsdASj2jUANnV0=",
         "owner": "appaquet",
         "repo": "dotfiles-secrets",
-        "rev": "092a814f0cefaeebc13655c1ca402cffcbe1d187",
+        "rev": "3db376ac6527f6dc5ed2a999d4f59a545e12eec0",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index adbeef2..6f01fdd 100755
--- a/flake.nix
+++ b/flake.nix
@@ -102,7 +102,8 @@
               inherit pkgs;
               modules = [ ./home-manager/deskapp.nix ] ++ commonHomeModules;
               extraSpecialArgs = {
-                inherit inputs unstablePkgs secrets;
+                inherit inputs unstablePkgs;
+                secrets = secrets.init "deskapp";
                 cfg = cfg // {
                   isNixos = true;
                 };
@@ -113,7 +114,8 @@
               inherit pkgs;
               modules = [ ./home-manager/nixapp.nix ] ++ commonHomeModules;
               extraSpecialArgs = {
-                inherit inputs unstablePkgs secrets;
+                inherit inputs unstablePkgs;
+                secrets = secrets.init "nixapp";
                 cfg = cfg // {
                   isNixos = true;
                 };
@@ -124,7 +126,8 @@
               inherit pkgs;
               modules = [ ./home-manager/servapp.nix ] ++ commonHomeModules;
               extraSpecialArgs = {
-                inherit inputs unstablePkgs cfg secrets;
+                inherit inputs unstablePkgs cfg;
+                secrets = secrets.init "servapp";
               };
             };
 
@@ -132,7 +135,8 @@
               inherit pkgs;
               modules = [ ./home-manager/mbpapp.nix ] ++ commonHomeModules;
               extraSpecialArgs = {
-                inherit inputs unstablePkgs cfg secrets;
+                inherit inputs unstablePkgs cfg;
+                secrets = secrets.init "mbapp";
               };
             };
           };
@@ -166,7 +170,8 @@
         nixapp = nixpkgs.lib.nixosSystem {
           specialArgs = {
             inherit (self) common;
-            inherit inputs secrets;
+            inherit inputs;
+            secrets = secrets.init "nixapp";
           };
           modules = [
             nixosOverlaysModule
@@ -177,7 +182,8 @@
         deskapp = nixpkgs.lib.nixosSystem {
           specialArgs = {
             inherit (self) common;
-            inherit inputs secrets;
+            inherit inputs;
+            secrets = secrets.init "deskapp";
           };
           modules = [
             nixosOverlaysModule
diff --git a/home-manager/modules/base.nix b/home-manager/modules/base.nix
index 4db27ae..cc9bff6 100644
--- a/home-manager/modules/base.nix
+++ b/home-manager/modules/base.nix
@@ -18,7 +18,7 @@
   programs.direnv.enable = true;
   programs.direnv.nix-direnv.enable = true;
 
-  home.packages = with pkgs; [
+  home.packages = (with pkgs; [
     manix # nix doc cli searcher
     nix-output-monitor # better nix build output (nom)
     nixpkgs-fmt
@@ -64,14 +64,17 @@
 
     curl
     wget
+    socat
 
     tealdeer # rust version of tldr
-    unstablePkgs.aichat # cli llm tool
 
     rsync
     rclone
-  ]
-  ++ lib.optionals stdenv.isLinux [
-    libtree # recursive ldd 
+  ])
+  ++ (with unstablePkgs; [
+    aichat # cli llm tool
+  ])
+  ++ lib.optionals pkgs.stdenv.isLinux [
+    pkgs.libtree # recursive ldd 
   ];
 }
diff --git a/home-manager/modules/dev.nix b/home-manager/modules/dev.nix
index d36d29c..7890f09 100644
--- a/home-manager/modules/dev.nix
+++ b/home-manager/modules/dev.nix
@@ -16,7 +16,7 @@ in
     secrets.homeManager.dev
   ];
 
-  home.packages = with pkgs;    [
+  home.packages = (with pkgs; [
     tokei
 
     dive # docker container explorer
@@ -28,8 +28,8 @@ in
 
     gnumake
     bintools # ld, objdump, etc.
-  ] ++ lib.optionals pkgs.stdenv.isLinux [
-    mold-wrapped
+  ]) ++ lib.optionals pkgs.stdenv.isLinux [
+    pkgs.mold-wrapped
   ];
 
   home.file.".cargo/config.toml".text = cargoConfig;
diff --git a/home-manager/modules/fish.nix b/home-manager/modules/fish.nix
index 4396529..2b0473f 100644
--- a/home-manager/modules/fish.nix
+++ b/home-manager/modules/fish.nix
@@ -76,11 +76,17 @@
       llt = "ll -t"; # sort by time
       lls = "ll -S"; # sort by size
 
-      nr = "nix run nixpkgs#(fzf-nix)";
-      ns = "nix shell nixpkgs#(fzf-nix)";
+      nr = {
+        expansion = "nix run nixpkgs#%";
+        setCursor = true;
+      };
+      ns = {
+        expansion = "nix shell nixpkgs#%";
+        setCursor = true;
+      };
+      nrf = "nix run nixpkgs#(fzf-nix)";
+      nsf = "nix shell nixpkgs#(fzf-nix)";
 
-      # TODO: Fix it with cursor since need quotes most of the time. See https://github.com/fish-shell/fish-shell/pull/9313
-      # https://github.com/nix-community/home-manager/blob/master/modules/programs/fish.nix#L170
       ai = {
         expansion = "aichat \"%\"";
         setCursor = true;
@@ -93,16 +99,6 @@
     };
 
     functions = {
-      # Reload fish with latest paths from nix.
-      # If not working, make sure that fish_user_paths are correctly set as explained in the README.
-      reload = ''
-        set CLEAR (which clear)
-        set -e PATH
-        set -e __HM_SESS_VARS_SOURCED
-        $CLEAR
-        ~/.nix-profile/bin/fish
-      '';
-
       # ripgrep & open files in vim
       vimrg = ''
         vim -c "Rg $argv"
diff --git a/home-manager/modules/git/default.nix b/home-manager/modules/git/default.nix
index dc0054b..4142fc8 100644
--- a/home-manager/modules/git/default.nix
+++ b/home-manager/modules/git/default.nix
@@ -32,7 +32,7 @@
       gca = "git commit --amend";
       gr = "git rev-parse --short=7 @";
       grc = "GIT_EDITOR=true git rebase --continue";
-      gri = "git rebase -i --committer-date-is-author-date";
+      gri = "git rebase -i --committer-date-is-author-date --autostash";
       grs = "git restore --staged";
       grsw = "git restore --staged --worktree";
       grws = "git restore --staged --worktree";
diff --git a/home-manager/modules/tmux/default.nix b/home-manager/modules/tmux/default.nix
index 2250386..f89d9f4 100644
--- a/home-manager/modules/tmux/default.nix
+++ b/home-manager/modules/tmux/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 let
   # See https://stackoverflow.com/questions/53658303/fetchfromgithub-filter-down-and-use-as-environment-etc-file-source
diff --git a/nixos/deskapp/configuration.nix b/nixos/deskapp/configuration.nix
index 54542a6..9a065d2 100644
--- a/nixos/deskapp/configuration.nix
+++ b/nixos/deskapp/configuration.nix
@@ -68,7 +68,6 @@
     interface = "eno1";
     lanIp = "192.168.0.30";
   };
-
   networking.hosts = {
     "100.109.193.77" = [ "localhost.humanfirst.ai" ];
   };
diff --git a/nixos/deskapp/virt/default.nix b/nixos/deskapp/virt/default.nix
index c538056..0d8bc33 100644
--- a/nixos/deskapp/virt/default.nix
+++ b/nixos/deskapp/virt/default.nix
@@ -1,4 +1,4 @@
-{ inputs, config, pkgs, ... }:
+{ inputs, ... }:
 
 {
   imports = [
diff --git a/nixos/dev.nix b/nixos/dev.nix
index 80c67c0..9099325 100644
--- a/nixos/dev.nix
+++ b/nixos/dev.nix
@@ -5,8 +5,9 @@
     inputs.vscode-server.nixosModule
   ];
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = (with pkgs; [
     distrobox
+  ]) ++ [
     config.boot.kernelPackages.perf # perf, aligned with current kernel version
   ];
 
diff --git a/nixos/network_bridge.nix b/nixos/network_bridge.nix
index 070adc7..838a7d8 100644
--- a/nixos/network_bridge.nix
+++ b/nixos/network_bridge.nix
@@ -46,5 +46,4 @@ in
     networking.defaultGateway = cfg.lanGateway;
     networking.nameservers = cfg.lanNameservers;
   };
-
 }
diff --git a/secrets b/secrets
index 092a814..3db376a 160000
--- a/secrets
+++ b/secrets
@@ -1 +1 @@
-Subproject commit 092a814f0cefaeebc13655c1ca402cffcbe1d187
+Subproject commit 3db376ac6527f6dc5ed2a999d4f59a545e12eec0
diff --git a/shells/backend/flake.nix b/shells/backend/flake.nix
index 004c753..05e4e9a 100644
--- a/shells/backend/flake.nix
+++ b/shells/backend/flake.nix
@@ -58,6 +58,7 @@
 
               nodejs
               yarn
+              jemalloc
 
               python3
               (poetry.override { python3 = python310; })
@@ -67,7 +68,7 @@
             # https://github.com/NixOS/nixpkgs/issues/18995
             hardeningDisable = [ "fortify" ];
 
-            NIX_LD_LIBRARY_PATH = with pkgs; pkgs.lib.makeLibraryPath [
+            NIX_LD_LIBRARY_PATH = with pkgs; lib.makeLibraryPath [
               stdenv.cc.cc
               clang
               llvmPackages.libclang
diff --git a/shells/exomind/flake.nix b/shells/exomind/flake.nix
index 1c9fd97..dd6be33 100644
--- a/shells/exomind/flake.nix
+++ b/shells/exomind/flake.nix
@@ -54,7 +54,7 @@
               openssl
             ];
 
-            NIX_LD_LIBRARY_PATH = with pkgs; pkgs.lib.makeLibraryPath [
+            NIX_LD_LIBRARY_PATH = with pkgs; lib.makeLibraryPath [
               stdenv.cc.cc
               clang
               llvmPackages.libclang