diff --git a/.sops.yaml b/.sops.yaml
index 55ae3a7f..6957a309 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -58,6 +58,7 @@ keys:
   - &stream age1j5csp5v5s2g8am47dd85kcke8986e0qc88f0vfgd3kmvwu8azg3smslk92
   - &storage-ng age1qjvds58pedjdk9rj0yqfvad4xhpteapr9chvfucwcgwrsr8n7axqyhg2vu
   - &ticker age1kdrpaqsy7gdnf80fpq6qrrc98nqjuzzlqx955uk2pkky3xcxky8sw9cdjl
+  - &prometheus age13xhxqulvswuckmpkmy2fgeqd5jx0ar8e2hst33leljt69r6hsvnsrdw63k
 
 creation_rules:
   - path_regex: config/[^/]+\.yaml$
@@ -91,6 +92,7 @@ creation_rules:
       - *mucbot
       - *nfsroot
       - *oparl
+      - *prometheus
       - *public-access-proxy
       - *pulsebert
       - *radiobert
@@ -187,3 +189,9 @@ creation_rules:
       age:
       - *storage-ng
       - *polygon-snowflake
+  - path_regex: hosts/prometheus/[^/]+\.yaml$
+    key_groups:
+    - pgp: *admins
+      age:
+      - *prometheus
+      - *polygon-snowflake