diff --git a/machines/control/configuration.nix b/machines/control/configuration.nix
index 60fdb80..c653964 100644
--- a/machines/control/configuration.nix
+++ b/machines/control/configuration.nix
@@ -14,6 +14,8 @@ in
     ../../modules/docs.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;
diff --git a/machines/gw-cnx-1/configuration.nix b/machines/gw-cnx-1/configuration.nix
index fc4dbb6..1a91225 100644
--- a/machines/gw-cnx-1/configuration.nix
+++ b/machines/gw-cnx-1/configuration.nix
@@ -8,6 +8,8 @@
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Until the install generates facter.json (which normally provides this).
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
diff --git a/machines/mx1/configuration.nix b/machines/mx1/configuration.nix
index d8ddb53..ff83e59 100644
--- a/machines/mx1/configuration.nix
+++ b/machines/mx1/configuration.nix
@@ -10,6 +10,8 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;
diff --git a/machines/ns1/configuration.nix b/machines/ns1/configuration.nix
index d5606a4..cdafc16 100644
--- a/machines/ns1/configuration.nix
+++ b/machines/ns1/configuration.nix
@@ -18,6 +18,8 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Knot's state dir holds the non-regenerable DNSSEC key material (KSK/ZSK
   # private keys in the KASP keystore). Declaring it as clan state makes the
   # borgbackup client back it up; losing it forces an emergency DS rollover at
diff --git a/machines/ns2/configuration.nix b/machines/ns2/configuration.nix
index 5207310..196aca7 100644
--- a/machines/ns2/configuration.nix
+++ b/machines/ns2/configuration.nix
@@ -10,6 +10,8 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix; matches the ns2 AAAA glue); SLAAC
   # doesn't bring it up here.
   cnx.staticIPv6 = {
diff --git a/machines/web01/configuration.nix b/machines/web01/configuration.nix
index 99f986e..1bc2127 100644
--- a/machines/web01/configuration.nix
+++ b/machines/web01/configuration.nix
@@ -9,6 +9,8 @@ in
     ../../modules/web-proxy.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;