diff --git a/home/.chezmoiignore.tmpl b/home/.chezmoiignore.tmpl
index bb0c7f4..9098c7a 100644
--- a/home/.chezmoiignore.tmpl
+++ b/home/.chezmoiignore.tmpl
@@ -5,4 +5,5 @@
 .ssh/id_rsa_personal
 .ssh/id_rsa_work.pub
 .ssh/id_rsa_personal.pub
-work_paths.txt
+work_paths
+work_packages
diff --git a/home/dot_zshenv.tmpl b/home/dot_zshenv.tmpl
index 5c14cdf..78a7322 100644
--- a/home/dot_zshenv.tmpl
+++ b/home/dot_zshenv.tmpl
@@ -73,7 +73,7 @@ check_paths=(
   # homebrew
   /opt/homebrew/bin
 
-  {{ join .chezmoi.sourceDir "encrypted_work_paths.txt" | include | decrypt -}}
+  {{ join .chezmoi.sourceDir "encrypted_work_paths.age" | include | decrypt -}}
 )
 
 for fp in $check_paths; do
diff --git a/home/encrypted_work_packages.age b/home/encrypted_work_packages.age
new file mode 100644
index 0000000..c275192
--- /dev/null
+++ b/home/encrypted_work_packages.age
@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRV1N4OElFeituUlRNSFcx
+YVVYSTVvVGpFMGs5am8vZTlEcCtLUDBTeVgwClZVL2s3RFd6R25HdkVDWk8rbnpl
+VnVKQ1B2NUw1WldvbFhBb3M0QVFMUUkKLS0tIFJuOWlBYmNRaXFHekRQeC9VeG5y
+bTV6dTdlSWFMSzJRYTZSWGtHR2Z1TzQKqVwn7lrI5Y4fctHqvEwy8LLRXH3DLG4d
+VCi3n8RJS3UsrgC+lGhqrgIdRNqSX0aldEbrntJ84yNIBRaJdeTO9nx9ml5bTp0R
+h4Fqept6XUpGwMGijTwUMwofyjkhpEjcvomQfOVccG9ZdpUym/apAdJ0N9qlC5xs
+UsgC5PCwmmGFXjyl7AvorXUzkGgQzjNolVo0acUaJEZ8p/zI286j6DSQFy3lv8nB
+cHleiDEUCmMCc8MWfMmQZZQN8aAwW4qksU0eBhj6JtzwojZIsg5dxe0PCJg15XDn
+pBNWvb49Jzec56eZN6a1fjzCW8sTxVIBlAZCM+eV5WaaK6+IlezKRfltEnYrL1RO
+wzLW2Ni+DCtzDEIX6Bj2uGgXTn3li5Clju9ye9GQbCqU+EY9aoz5u9rrAFZ/So+b
+Zc63ZkFuUVsh8UosgC8UluPNPheMqQb8fkdHzpynyKNRlLxBO8Xw4Ii0t9KfkKLL
+AHc+rpBCLabk6eNG3M5zQFCZfoYgY2x8Go5ZDfI1KLjLWfL5m87dVVTcCGhAFYeZ
+rfn+KPTuaR08bVbwV8Fq9a2+4GCczWLOy4SIwzASKQc/tMXPGRiC
+-----END AGE ENCRYPTED FILE-----
diff --git a/home/encrypted_work_paths.txt b/home/encrypted_work_paths.age
similarity index 100%
rename from home/encrypted_work_paths.txt
rename to home/encrypted_work_paths.age
diff --git a/home/run_once_01install-packages.sh.tmpl b/home/run_once_01install-packages.sh.tmpl
index 083269b..1dc7c61 100644
--- a/home/run_once_01install-packages.sh.tmpl
+++ b/home/run_once_01install-packages.sh.tmpl
@@ -52,33 +52,5 @@ sudo apt install \
 {{ end }}
 
 {{ if eq .hosttype "work" -}}
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-eval "$(/opt/homebrew/bin/brew shellenv)"
-brew install \
-  bzip2 \
-  cmus \
-  curl \
-  direnv \
-  fzf \
-  git \
-  git-delta \
-  helix \
-  jj \
-  kitty \
-  libmemcached \
-  openssl@1.1 \
-  readline \
-  ripgrep \
-  snappy \
-  sqlite \
-  tmux \
-  tree \
-  watch \
-  wget \
-  xz \
-  zellij \
-  zk \
-  zlib \
-  zsh \
-  zstd
+  {{ join .chezmoi.sourceDir "encrypted_work_packages.age" | include | decrypt -}}
 {{ end }}