diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2daaff84..a76ddcd0 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T17:08:50Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 name: default
 concurrency:
@@ -47,11 +47,18 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: js
         run: |
           make js
@@ -114,8 +121,6 @@ jobs:
           make omnictl
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "true"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|Auth/|DefaultCluster/
           WITH_DEBUG: "true"
@@ -197,11 +202,18 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
@@ -212,8 +224,6 @@ jobs:
           xargs -a _out/executable-artifacts -I {} chmod +x {}
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|EtcdBackupAndRestore
           WITH_DEBUG: "true"
@@ -250,11 +260,18 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
@@ -265,8 +282,6 @@ jobs:
           xargs -a _out/executable-artifacts -I {} chmod +x {}
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|ScaleUpAndDown/|ScaleUpAndDownMachineClassBasedMachineSets/|RollingUpdateParallelism/|ForcedMachineRemoval/|ReplaceControlPlanes/|ConfigPatching/|KubernetesNodeAudit/
           WITH_DEBUG: "true"
@@ -303,11 +318,18 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
@@ -318,8 +340,6 @@ jobs:
           xargs -a _out/executable-artifacts -I {} chmod +x {}
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosImageGeneration/|ImmediateClusterDestruction/|DefaultCluster/|EncryptedCluster/|SinglenodeCluster/|Auth/
           WITH_DEBUG: "true"
@@ -356,11 +376,18 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
@@ -371,8 +398,6 @@ jobs:
           xargs -a _out/executable-artifacts -I {} chmod +x {}
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|ClusterTemplate/
           WITH_DEBUG: "true"
@@ -409,11 +434,18 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
@@ -424,8 +456,6 @@ jobs:
           xargs -a _out/executable-artifacts -I {} chmod +x {}
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosUpgrades/|KubernetesUpgrades/|MaintenanceDowngrade/
           WITH_DEBUG: "true"
diff --git a/.github/workflows/e2e-backups-cron.yaml b/.github/workflows/e2e-backups-cron.yaml
index 0b9d9755..07f08d71 100644
--- a/.github/workflows/e2e-backups-cron.yaml
+++ b/.github/workflows/e2e-backups-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T16:16:58Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 name: e2e-backups-cron
 concurrency:
@@ -30,15 +30,20 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|EtcdBackupAndRestore
           WITH_DEBUG: "true"
diff --git a/.github/workflows/e2e-scaling-cron.yaml b/.github/workflows/e2e-scaling-cron.yaml
index 4cdfe925..9b53c61e 100644
--- a/.github/workflows/e2e-scaling-cron.yaml
+++ b/.github/workflows/e2e-scaling-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T17:08:50Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 name: e2e-scaling-cron
 concurrency:
@@ -30,15 +30,20 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|ScaleUpAndDown/|ScaleUpAndDownMachineClassBasedMachineSets/|RollingUpdateParallelism/|ForcedMachineRemoval/|ReplaceControlPlanes/|ConfigPatching/|KubernetesNodeAudit/
           WITH_DEBUG: "true"
diff --git a/.github/workflows/e2e-short-cron.yaml b/.github/workflows/e2e-short-cron.yaml
index b5b6228d..15c213f8 100644
--- a/.github/workflows/e2e-short-cron.yaml
+++ b/.github/workflows/e2e-short-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T16:16:58Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 name: e2e-short-cron
 concurrency:
@@ -30,15 +30,20 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosImageGeneration/|ImmediateClusterDestruction/|DefaultCluster/|EncryptedCluster/|SinglenodeCluster/|Auth/
           WITH_DEBUG: "true"
diff --git a/.github/workflows/e2e-templates-cron.yaml b/.github/workflows/e2e-templates-cron.yaml
index c05eb264..e5fb78e5 100644
--- a/.github/workflows/e2e-templates-cron.yaml
+++ b/.github/workflows/e2e-templates-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T16:16:58Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 name: e2e-templates-cron
 concurrency:
@@ -30,15 +30,20 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|ClusterTemplate/
           WITH_DEBUG: "true"
diff --git a/.github/workflows/e2e-upgrades-cron.yaml b/.github/workflows/e2e-upgrades-cron.yaml
index 3afc511f..8a443b48 100644
--- a/.github/workflows/e2e-upgrades-cron.yaml
+++ b/.github/workflows/e2e-upgrades-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T16:16:58Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 name: e2e-upgrades-cron
 concurrency:
@@ -30,15 +30,20 @@ jobs:
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
+        id: setup-buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: remote
           endpoint: tcp://127.0.0.1:1234
         timeout-minutes: 10
+      - name: Mask secrets
+        run: |
+          echo -e "$(sops -d .secrets.yaml | yq '.secrets | to_entries[] | "::add-mask::" + .value')"
+      - name: Set secrets for job
+        run: |
+          sops -d .secrets.yaml | yq '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
       - name: run-integration-test
         env:
-          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
           INTEGRATION_RUN_E2E_TEST: "false"
           INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosUpgrades/|KubernetesUpgrades/|MaintenanceDowngrade/
           WITH_DEBUG: "true"
diff --git a/.kres.yaml b/.kres.yaml
index 038154df..60c4de50 100644
--- a/.kres.yaml
+++ b/.kres.yaml
@@ -152,6 +152,7 @@ spec:
         @hack/test/integration.sh
   ghaction:
     enabled: true
+    sops: true
     artifacts:
       enabled: true
       extraPaths:
@@ -167,8 +168,6 @@ spec:
       WITH_DEBUG: "true"
       INTEGRATION_RUN_E2E_TEST: "true"
       INTEGRATION_TEST_ARGS: "--test.run CleanState/|Auth/|DefaultCluster/"
-      AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
-      AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
     jobs:
       - name: e2e-short
         crons:
@@ -234,6 +233,20 @@ spec:
     - "hack/generate-certs/certs"
     - "hack/compose/docker-compose.override.yml"
 ---
+kind: common.SOPS
+spec:
+  enabled: true
+  config: |-
+    creation_rules:
+      - age: age1xrpa9ujxxcj2u2gzfrzv8mxak4rts94a6y60ypurv6rs5cpr4e4sg95f0k
+        # order: Andrey, Noel, Artem, Utku, Dmitriy
+        pgp: >-
+          15D5721F5F5BAF121495363EFE042E3D4085A811,
+          CC51116A94490FA6FB3C18EB2401FCAE863A06CA,
+          4919F560F0D35F80CF382D76E084A2DF1143C14D,
+          966BC282A680D8BB3E8363E865933E76F0549B0D,
+          AA5213AF261C1977AF38B03A94B473337258BFD5
+---
 kind: golang.Build
 name: omni
 spec:
@@ -503,8 +516,6 @@ spec:
         - .vue
       skipPaths:
         - node_modules/
-
-  enableConform: true
   enforceContexts:
     - e2e-short
     - e2e-scaling
diff --git a/.secrets.yaml b/.secrets.yaml
new file mode 100644
index 00000000..999cfc75
--- /dev/null
+++ b/.secrets.yaml
@@ -0,0 +1,82 @@
+secrets:
+    AUTH0_TEST_USERNAME: ENC[AES256_GCM,data:lPddHbDVfWxaEW7ujLDnWdhIBMFj2hcp,iv:oG3Ebn8ym7g/Z7L3A3BTHRHIk+zzblZKvzMKYMPSfWI=,tag:wV7xJWbnLrj/UWj0fGGQCw==,type:str]
+    AUTH0_TEST_PASSWORD: ENC[AES256_GCM,data:3tgQjqv5ktdnnGUQw5Lpuw==,iv:F8zYxqk5P0tV1Pvt6QBlho8H0wuX+K91pgwLzF+4kC8=,tag:HJ4s14d/u2KyP780wFDk/w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1xrpa9ujxxcj2u2gzfrzv8mxak4rts94a6y60ypurv6rs5cpr4e4sg95f0k
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUExvc1oyUzdVNmgrbHh3
+            cDllQ2VGSzZLQWV5MkN0VU1qTjVqblFvekJZCkdyREg2RUhVSXQwM1lpcjBkb0dG
+            b0krdTI1MVQxcE4zSElsd0liS0xrYncKLS0tIG1nSmhVa2Z1YkhjdHpnQmg5b1lL
+            NXI3VkxLU0htQUZ0Ry8rYUpLTnNXYlkKzfLUus7SkKBEj+oG3f7NBe+6UVidpxRd
+            OvOSqsACIUJJnRdfs8/X5Jbvruz38Zt3dYR436NFo2IHtYUdHIHO3Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-18T17:04:12Z"
+    mac: ENC[AES256_GCM,data:5/rb0mtPxV7llLsWZYKpRw6EZptcLCcBCl9g5De1z7IBfvFnvs/kiZr2Q/mZtewveVACEuy9K+cy4hPuf1o1QjdVhrLh+nMj5rb0WQtuHDMhEI8Jz/BEJoXvkg29UE3Ow09n4BCo3aQ0y9v+Lep5Y16HlYzo5HLHvU+vuGXL+zw=,iv:YQyTbs0E8sylUP4nAnDCVn452Cw44YSD5vGJeNngHzc=,tag:hSVilzB800vvjv7bb12klg==,type:str]
+    pgp:
+        - created_at: "2024-04-18T18:21:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D/dYBJRlWfQISAQdAVAV7d4BdulmFD+opnoDgxoIcDlIGn2n7c2aWbeF1qjYw
+            eHfSb/A/1Anwi+uA7fXAqAayhlfTFTr9xdKr9zp+rDQt09/QN9EKG2F9gBq0LPCl
+            0lwBAxelOP0EUjXZtpsVk8FVZcBeuYt+U+DrAVr8yT3TUiyFvavzpxxCqUYFBjvy
+            z5DUSCs+YUDLpQ/Gde0qBW8LU6HO2LAGkIvfO/HAd35jVHT5EvXivMlaRb+qBg==
+            =hdU9
+            -----END PGP MESSAGE-----
+          fp: 15D5721F5F5BAF121495363EFE042E3D4085A811
+        - created_at: "2024-04-18T18:21:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D+EORkHurkvgSAQdAOxZd1WYD0pC25Y7bBmPhlz9+udxy+RiwaxL2RXs2/xYw
+            cIvqsTY4wokWKD3s1nFmqHDXU3GQ7+V+pCS1PXTs7YH3uwXLBaT86AUgp+JoLJmN
+            0lwBuFrV4rSBQ5NvY1lGmOz6zaZlf3oBvVX510bvLPG6RfUqxE5WkMl+XgYtoKNa
+            eK2uknJ5UhMKYJpYwi0Jcj6Ip3s0Bzt2ZR4SMYvw7QzXPvJ1W3GKboOjJAxqoQ==
+            =YydP
+            -----END PGP MESSAGE-----
+          fp: CC51116A94490FA6FB3C18EB2401FCAE863A06CA
+        - created_at: "2024-04-18T18:21:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DCsA/BhMt3V4SAQdAtLfcBQyS/chcBtMAz6cJ/q/jZihioun7AZssYBzGdFIw
+            jwXCKTbTFAG7ebentk4dDLYWxRRwY/lHsWyAS1kDSSfQVZNfK+ZoTrGIG1J6MYDD
+            0lwBazJw7Xh+MBXt9nz/Pdor4Jlnerl1PvO3BsDvql5ESbWZS/OOSFGTvuq9ZUG0
+            RRlvN38NSNz+R1D79U+iwsJDJ7s8qUPCNckAoU3RWkqa7Sv1rpnwLPBqZ4t6bA==
+            =JQty
+            -----END PGP MESSAGE-----
+          fp: 4919F560F0D35F80CF382D76E084A2DF1143C14D
+        - created_at: "2024-04-18T18:21:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMAxQwM84t19oOAQf/TQnaKyseOPFTpIMXoZAHsJ71jVGTdevAhOK9Vrq4ULwk
+            Mb/QIyjLssrxBKU2AeXPXHM3SfiboqRsfoUKLuTmBI+BZyq6xXSA5HPElS+VcodE
+            sLTce4en+YeWvcJ5vioNCqj0P6GTEdZfB5bXRzhJArQMyyEGvAaQG/5SKI8lJ4gW
+            q0jXhwWy3qZRGj+X35y+vjlorwIEjPDrrh3lddnt+I1uVO2SKO4irbO3OiLAHRUM
+            bTyeIdqsVJN9tWdlotPIA5+IQK+Bd+G6Tu4rGnKxsEo2wTfomcR99HTBLYIVkVSm
+            iswaGDffJ3DAIWEBUDdOZD1zOOAb0xESkkEfIbfcxdJcAesPBVc/jkL9cd17oHCU
+            sSEDeQnkFcwwfa3Lvo91CqrXx/I9Np/D6Ir/BsdYl4IUrcOtpYjVRQh3V9MfXpuY
+            RST6NbjIziAMOPbJaxXKOZbT+inksnFvblo39HE=
+            =5g11
+            -----END PGP MESSAGE-----
+          fp: 966BC282A680D8BB3E8363E865933E76F0549B0D
+        - created_at: "2024-04-18T18:21:00Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DzfZC0UNQ1VgSAQdABhWHHlBVw7gq430dMuRHIzJ4u6f5oVh8jXBbMGG8tXow
+            lBUy2Qo9sGgN/2Nu9/W+efxs31oceerrw4DMSalC/KWvq3teVWc8TYeHYNAd/4ci
+            0lwB/UsGhZio7njWdmt7chOHJgM76JUEb4eaEZCVhQCCBDTIaFffMF2b0gpgyG9p
+            orZob5tXAl1RsYS9ZDAlGWpuicfZ8CUxQvdSKzwBzBrBJhs+CvNVk/NFWXNS3Q==
+            =N/JL
+            -----END PGP MESSAGE-----
+          fp: AA5213AF261C1977AF38B03A94B473337258BFD5
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 00000000..54d08e46
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,13 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-04-18T18:20:58Z by kres 92eef68-dirty.
+
+creation_rules:
+  - age: age1xrpa9ujxxcj2u2gzfrzv8mxak4rts94a6y60ypurv6rs5cpr4e4sg95f0k
+    # order: Andrey, Noel, Artem, Utku, Dmitriy
+    pgp: >-
+      15D5721F5F5BAF121495363EFE042E3D4085A811,
+      CC51116A94490FA6FB3C18EB2401FCAE863A06CA,
+      4919F560F0D35F80CF382D76E084A2DF1143C14D,
+      966BC282A680D8BB3E8363E865933E76F0549B0D,
+      AA5213AF261C1977AF38B03A94B473337258BFD5
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 6139f15a..d5f8759c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,14 +2,14 @@
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T16:16:58Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 ARG JS_TOOLCHAIN
 ARG TOOLCHAIN
 
-FROM ghcr.io/siderolabs/ca-certificates:v1.6.0 AS image-ca-certificates
+FROM ghcr.io/siderolabs/ca-certificates:v1.7.0 AS image-ca-certificates
 
-FROM ghcr.io/siderolabs/fhs:v1.6.0 AS image-fhs
+FROM ghcr.io/siderolabs/fhs:v1.7.0 AS image-fhs
 
 # base toolchain image
 FROM ${JS_TOOLCHAIN} AS js-toolchain
@@ -21,7 +21,7 @@ ENV GOPATH /go
 ENV PATH ${PATH}:/usr/local/go/bin
 
 # runs markdownlint
-FROM docker.io/node:21.7.1-alpine3.19 AS lint-markdown
+FROM docker.io/node:21.7.3-alpine3.19 AS lint-markdown
 WORKDIR /src
 RUN npm i -g markdownlint-cli@0.39.0
 RUN npm i sentences-per-line@0.2.1
diff --git a/Makefile b/Makefile
index de4d9111..a97afc9d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-04-17T16:16:58Z by kres 92eef68.
+# Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 # common variables
 
@@ -70,7 +70,7 @@ COMMON_ARGS += --build-arg=GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
 COMMON_ARGS += --build-arg=GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)"
 COMMON_ARGS += --build-arg=GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
 COMMON_ARGS += --build-arg=TESTPKGS="$(TESTPKGS)"
-JS_TOOLCHAIN ?= docker.io/node:21.7.1-alpine3.19
+JS_TOOLCHAIN ?= docker.io/node:21.7.3-alpine3.19
 TOOLCHAIN ?= docker.io/golang:1.22-alpine
 
 # extra variables
diff --git a/internal/frontend/frontend.go b/internal/frontend/frontend.go
index 3fd3fa1d..c35e40d2 100644
--- a/internal/frontend/frontend.go
+++ b/internal/frontend/frontend.go
@@ -5,7 +5,7 @@
 
 // THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 //
-// Generated on 2024-04-17T17:08:50Z by kres 92eef68.
+// Generated on 2024-04-19T08:33:46Z by kres add13d7.
 
 package frontend