diff --git a/bin/homelab b/bin/homelab
index a5d4835..d3fe674 100755
--- a/bin/homelab
+++ b/bin/homelab
@@ -263,6 +263,15 @@ def cmd_secret(args: argparse.Namespace) -> int:
     path = CONTEXT / "secrets" / f"{name}.yaml"
     if not path.exists():
         die(f"no secret '{name}' (looked for {path})")
+    # The age key lives at /etc/age/key.txt (root:root 0600) so non-root
+    # users can't read it — or even stat it, since /etc/age is 0700 root.
+    # Re-exec via sudo when invoked as a regular user.
+    if os.geteuid() != 0:
+        return subprocess.call([
+            "sudo", "-E",
+            "env", f"SOPS_AGE_KEY_FILE={AGE_KEY}",
+            "sops", "-d", str(path),
+        ])
     if not AGE_KEY.exists():
         die(f"no age key at {AGE_KEY} — has bootstrap run?")
     env = {**os.environ, "SOPS_AGE_KEY_FILE": str(AGE_KEY)}