diff --git a/config/services/nfs/default.nix b/config/services/nfs/default.nix
index 7448388d..04137370 100644
--- a/config/services/nfs/default.nix
+++ b/config/services/nfs/default.nix
@@ -1,9 +1,9 @@
 { config, lib, kw, ... }:
 
+with lib;
+
 {
-  imports = [
-    config.kw.repoSecrets.nfs.source
-  ];
+  imports = optional config.deploy.profile.trusted (singleton config.kw.repoSecrets.nfs.source);
 
   network.firewall = {
     private.tcp.ports = [ 111 2049 ];
diff --git a/config/services/znc/default.nix b/config/services/znc/default.nix
index 135aa0e3..99e0564d 100644
--- a/config/services/znc/default.nix
+++ b/config/services/znc/default.nix
@@ -165,7 +165,7 @@ in {
           };
         };
       })
-      (import config.kw.repoSecrets.znc.source)
+      (mkIf config.deploy.profile.trusted (import config.kw.repoSecrets.znc.source))
     ];
     configFile = config.secrets.files.znc-config.path;
   };