diff --git a/config/users/kat/personal/bitw.nix b/config/users/kat/personal/bitw.nix
index bb42033f..be32a3c6 100644
--- a/config/users/kat/personal/bitw.nix
+++ b/config/users/kat/personal/bitw.nix
@@ -1,7 +1,7 @@
 { config, pkgs, lib, ... }: {
   programs.rbw = {
     enable = true;
-    package = pkgs.writeShellScriptBin "bitw" ''${pkgs.rbw-bitw}/bin/bitw -p gpg://${config.kw.repoSecrets.bitw.source} "$@"'';
+    package = mkIf config.deploy.profile.trusted (pkgs.writeShellScriptBin "bitw" ''${pkgs.rbw-bitw}/bin/bitw -p gpg://${config.kw.repoSecrets.bitw.source} "$@"'');
     settings = {
       email = "kat@kittywit.ch";
       base_url = "https://vault.kittywit.ch";