diff --git a/home-manager/progs/pi.nix b/home-manager/progs/pi.nix
index 9b529b8..045498b 100644
--- a/home-manager/progs/pi.nix
+++ b/home-manager/progs/pi.nix
@@ -18,11 +18,16 @@ let
     };
   };
 
-  # provider config — openrouter API key read from secrets at runtime
+  # provider config — secrets read at eval time via builtins.readFile
+  # (omp treats apiKey as env-var-name-or-literal, not a shell command)
   ompModels = {
     providers = {
       openrouter = {
-        apiKey = "!cat ${../secrets/openrouter_api_key}";
+        apiKey = lib.strings.trim (builtins.readFile ../secrets/openrouter_api_key);
+      };
+      "llama.cpp" = {
+        baseUrl = "https://llm.sigkill.computer";
+        apiKey = lib.strings.trim (builtins.readFile ../secrets/llama_cpp_api_key);
       };
     };
   };
diff --git a/home-manager/secrets/llama_cpp_api_key b/home-manager/secrets/llama_cpp_api_key
new file mode 100644
index 0000000..7aba54f
Binary files /dev/null and b/home-manager/secrets/llama_cpp_api_key differ