diff --git a/inventories/z9/host_vars/z9-router.sops.yaml b/inventories/z9/host_vars/z9-router.sops.yaml
index 33bd3c83..f5e40d1d 100644
--- a/inventories/z9/host_vars/z9-router.sops.yaml
+++ b/inventories/z9/host_vars/z9-router.sops.yaml
@@ -2,22 +2,31 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:TlMDo9sUTYznxKOGityGLexk54mM7
 secrets__secrets:
   - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str]
     content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str]
+    group: ENC[AES256_GCM,data:SnVl,iv:GgdWFZ1tMFaUacisA47oJBXDgG11uHfw8tBYcPQt844=,tag:pHtSdg+9qPmm+Vm5gTanpg==,type:int]
   - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str]
     content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str]
+    group: ENC[AES256_GCM,data:9zAa,iv:Cb4tNsiPKWrkdIHHSGvK10FwGeInPetReVnW0JUTEHw=,tag:THD3QfnWb5fLXluVRFzuag==,type:int]
   - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str]
     content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str]
+    group: ENC[AES256_GCM,data:Pv0/,iv:Gh6X7H+DkIO64lpcDrsH5nmWwRZRU9avs40HG1eiFcA=,tag:oGMD/kqgd0pl+BeQO7LqQw==,type:int]
   - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str]
     content: ENC[AES256_GCM,data:W2h5AcoT85OkekPeRkrf1m0bDdBjG/YNSbWlrcZtP7FjaPh/F+cx+J6oRRI=,iv:CLVXTqfstpIU3BX/Zdcnp9w0gWxeGDI/G1MNl6xr4ZU=,tag:yCqN4r1MV/VTWQvZ6COfIw==,type:str]
+    group: ENC[AES256_GCM,data:m3q2,iv:BKsE9OL4FMZpDS9zS+TiNvjR5jQ7EAsw9ER73Q9oSEE=,tag:r31ZCaMO4S2Pmk+FdDsdQA==,type:int]
   - name: ENC[AES256_GCM,data:IRwwy+WQxgQ8cDpB8HaCLpKwJj7oC87p0XOxWRo=,iv:BLXNMcigvaOeY6y4NlLPMMWQt9XFi6nodRwIYFgAAnU=,tag:OdQalmujOgrzW8oi64xMRg==,type:str]
     content: ENC[AES256_GCM,data:C5oIcuEYtODsvjQZnbqbWVfP63mQzcRuh8f5rlBCyjwSq2mZiYGQe9t0T78=,iv:sITUDo9SKZTSwPfsMv4m4U0ruuVCcaxu7SUT52U4FSE=,tag:4CsSMJWQQPAIeK8DwUDBqg==,type:str]
+    group: ENC[AES256_GCM,data:UEeH,iv:P/maaKER4lCW9/oASsJH+QBy5U1uHythvefRRnlXjn0=,tag:aXSow6dtU7VeGEtQQacHIw==,type:int]
   - name: ENC[AES256_GCM,data:r0sbpjaGjezoNlyl1khy+Dly+8xbbfQZNB8om/E4/tj9lmM=,iv:MLrglBJA6BrHGmFRprlQcf5/Hqh952e5OyQQ9nPxumY=,tag:Se05kMBkSQ7TRxzij7Fo8A==,type:str]
     content: ENC[AES256_GCM,data:/c1nRf1eZhbUmoQWvcj8yDaVPtyAN7Uu+S054q3C1/kXlQ7CgOe4CrMXnmk=,iv:ppar0aCKuIU3DOjwAoliZ5TOL199Z+Ffo4pCktjs0W8=,tag:nfaGutK+5KnlWBKU1MTxkQ==,type:str]
+    group: ENC[AES256_GCM,data:P/P+,iv:B0WlRVgZEgSQRsiRfi5o2+lXkFIZ8Oy5uemtwU06zPw=,tag:D5fs5HF1pKckRNVm+6r/pg==,type:int]
   - name: ENC[AES256_GCM,data:7mwuykEqbGISOa2n+pWb6INLsHYdjyf2HxTtWpAr5xP1,iv:NMcg+L2DFtBO1nhyPid31yzLr+ZX7DUGl/WxV1MnrqU=,tag:65/BiUEI8v5oMlQqpKNDRg==,type:str]
     content: ENC[AES256_GCM,data:SObbA3D/sGN5/i5ps4Zz3alygIXKbSgptFjfPHlwC8G588O+gKAkvKQwU/s=,iv:PY2vLfI3gInFeQbse49KC2/zZ9O4jeXAQ0fpP84GHHE=,tag:214Mb8hIYDkQ4+UkRWtc9w==,type:str]
+    group: ENC[AES256_GCM,data:ysBR,iv:ewZ73lNcdx5KQTM/HQRhptSqAqKgZzAhIubrqDp0ueg=,tag:RqcrNGQwkLufo2bdn1WJXQ==,type:int]
   - name: ENC[AES256_GCM,data:bES9O6JI4wTnuZsup9gflfaozeUDkfjVGNIFn8RnZQ==,iv:98kigM3KZIN5qXNdgfLg5WLmxzAsYCjNqVzyUPco/BI=,tag:1fwEtwQ6i9QQC3OCewN0eA==,type:str]
     content: ENC[AES256_GCM,data:flO3Nb4u2WfWNVhn8k5Bgo3LmsHo2cVnLCsrz8ST9Ip7gO9FY9d27FQgphM=,iv:aiDoq+41cSjwcCZRaIPLtbltkOpc7FeuNN7swPqkHXQ=,tag:OhzcY2xKKJF2jZVRseXCFg==,type:str]
+    group: ENC[AES256_GCM,data:YGOs,iv:QjGXlX90R7zqIeUQGIblD6aYtzqpGxc6hW0nT+2q84c=,tag:7kRcKtQTp9teaP+Yw1x4MA==,type:int]
   - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str]
     content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str]
+    group: ENC[AES256_GCM,data:2P64,iv:mOdlGn9zSb/Z97R6FBAJSZhk/g4hVOBwCI4/j3BwhPQ=,tag:OcvhT6QVfJvAYYBQyHPykg==,type:int]
 sops:
   age:
     - enc: |
@@ -29,8 +38,8 @@ sops:
         tnFHmQgnEPypIhVvZtzL7i64kL6sHizTmNhbw+hlnCztvsdEV5T0cw==
         -----END AGE ENCRYPTED FILE-----
       recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp
-  lastmodified: "2026-05-25T17:15:30Z"
-  mac: ENC[AES256_GCM,data:IW9eN5H2J5cnXUHlK2aD+yd2ORx+weSFKBGWd7pIolFb5txg0WlGVp8UpD4h+Tv0SJ9NkQOT6KpcXDez/L7r7xNYtmgf7AdrdGpy3IOkEYzHJ+oHUMd/aL+h5w6/RahrpxlPSrNKAC+AfpY+l0iodwQ09iuLp4YXFxRaRDGpGZw=,iv:6M7RkDN9D9Zlyq1MCRoiT4f1bd6OBZNg+C65oEuSWn4=,tag:wRsq4lt4mHVyY6ruGkYNKQ==,type:str]
+  lastmodified: "2026-08-07T21:01:32Z"
+  mac: ENC[AES256_GCM,data:pVSBNwQVHta0vrUi9ZIo/+FLHZaeS+/R/xtNCvC+/NlEaksqcP7jQ8/Dk4DZAlPVtdupkKco0YqfTomccrp59BcAL9DAw1HpHJOeLhBdgB99fcWAkbGnzNIRS0/bOco+sDQUXGxg2HlQpFuwMFYQIfHFyqD0ivNSwLSHflrSwAM=,iv:7U9X87wd6/3SDun+BLgILH9XHJJY+GAlJd6kRSBfRGQ=,tag:wk/Hb1nw8MmLE5B08AC3jA==,type:str]
   pgp:
     - created_at: "2026-05-25T17:17:14Z"
       enc: |-
@@ -206,4 +215,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
   unencrypted_suffix: _unencrypted
-  version: 3.13.1
+  version: 3.13.3
diff --git a/inventories/z9/host_vars/z9-router.yaml b/inventories/z9/host_vars/z9-router.yaml
index 2cd3ee14..ee5ab3f4 100644
--- a/inventories/z9/host_vars/z9-router.yaml
+++ b/inventories/z9/host_vars/z9-router.yaml
@@ -8,3 +8,7 @@ deploy_systemd_resolved_config__enable: false
 deploy_systemd_resolved_config__dns:
   - 127.0.0.1
 kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml
+secrets__folder:
+  owner: "root"
+  mode: "0754"
+  group: 998