diff --git a/README.md b/README.md
index 8886ed6..9f94576 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ Workaround: define a custom `zai-coding` provider in `~/.omp/agent/models.yml` p
 
 Gotcha: omp's `apiKey:` field in custom providers expects a **literal key value** — NOT an env var name. `apiKey: ZAI_CODING_API_KEY` was being treated as the literal string `ZAI_CODING_API_KEY` and sent as `Authorization: Bearer ZAI_CO...KEY` → 401. The encrypted `models.yml` in this repo contains the literal Z.ai API key in `apiKey:` (same key that's in `zai.key`).
 
-`run_onchange_35-ensure-omp-models-perms.sh` chmod 600s the decrypted file so the literal key isn't world-readable (matches `zai.key`'s tighter perms).
+All three omp secrets (`zai.key`, `.env`, `models.yml`) are committed as `encrypted_private_*.age`. The prefix order matters: chezmoi parses attribute prefixes left-to-right, and `encrypted_` **must** precede `private_`. `encrypted_private_foo.age` decrypts *and* lands at `0600`; the reversed `private_encrypted_foo.age` makes chezmoi consume `private_` and then treat `encrypted_foo.age` as a literal filename (no decryption — the file is copied verbatim, which is how a stale `encrypted_models.yml.age` blob ended up in `~/.omp/agent/`). As belt-and-suspenders for boxes where a secret already sits at umask `0644` from a prior apply, `run_onchange_35-ensure-omp-secret-perms.sh` normalizes all three back to `600`. Never rely on the enclosing `~/.omp/agent/` directory being `700` to protect these; the files carry their own mode.
 
 ## Sway / Wayland desktop stack
 
diff --git a/dot_omp/agent/encrypted_.env.age b/dot_omp/agent/encrypted_private_.env.age
similarity index 100%
rename from dot_omp/agent/encrypted_.env.age
rename to dot_omp/agent/encrypted_private_.env.age
diff --git a/dot_omp/agent/private_encrypted_models.yml.age b/dot_omp/agent/encrypted_private_models.yml.age
similarity index 100%
rename from dot_omp/agent/private_encrypted_models.yml.age
rename to dot_omp/agent/encrypted_private_models.yml.age
diff --git a/dot_omp/agent/encrypted_zai.key.age b/dot_omp/agent/encrypted_private_zai.key.age
similarity index 100%
rename from dot_omp/agent/encrypted_zai.key.age
rename to dot_omp/agent/encrypted_private_zai.key.age
diff --git a/run_onchange_35-ensure-omp-models-perms.sh.tmpl b/run_onchange_35-ensure-omp-models-perms.sh.tmpl
deleted file mode 100644
index 7c1e19f..0000000
--- a/run_onchange_35-ensure-omp-models-perms.sh.tmpl
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-#  run_onchange_35-ensure-omp-models-perms.sh.tmpl
-#  Force chmod 600 on ~/.omp/agent/models.yml. The encrypted file is named
-#  `private_encrypted_models.yml.age` so chezmoi SHOULD set 600 on first apply,
-#  but if the file already exists from a prior apply (when it was named
-#  `encrypted_models.yml.age` without the `private_` prefix), the perm stays
-#  at whatever umask gave it (typically 644). This script normalizes the perm
-#  to 600 so the literal zai API key in models.yml isn't world-readable.
-#
-#  Triggered by the body hash changing; current hash = sha256 of body.
-#  Runs on all OSes (no os_family gate).
-# =============================================================================
-set -euo pipefail
-
-MODELS_YML="${HOME}/.omp/agent/models.yml"
-
-log() { printf '\033[1;34m[omp-models-perms]\033[0m %s\n' "$*"; }
-
-if [[ ! -f "$MODELS_YML" ]]; then
-    log "models.yml not present on this box (omp not installed?) — skipping"
-    exit 0
-fi
-
-current_perm=$(stat -c '%a' "$MODELS_YML")
-if [[ "$current_perm" == "600" ]]; then
-    log "models.yml already 600 — nothing to do"
-    exit 0
-fi
-
-log "models.yml perm is $current_perm, fixing to 600"
-chmod 600 "$MODELS_YML"
-log "models.yml perm now $(stat -c '%a' "$MODELS_YML")"
diff --git a/run_onchange_35-ensure-omp-secret-perms.sh.tmpl b/run_onchange_35-ensure-omp-secret-perms.sh.tmpl
new file mode 100755
index 0000000..fec325d
--- /dev/null
+++ b/run_onchange_35-ensure-omp-secret-perms.sh.tmpl
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_onchange_35-ensure-omp-secret-perms.sh.tmpl
+#  Force chmod 600 on every omp secret under ~/.omp/agent/. The encrypted
+#  sources are all named with the `private_` prefix (private_encrypted_*.age)
+#  so chezmoi SHOULD set 600 on first apply, but if a file already exists
+#  from a prior apply (before it gained the `private_` prefix), its mode
+#  stays at whatever umask gave it (typically 644 — world-readable).
+#  This script normalizes the mode so live API keys are never world-readable,
+#  regardless of the enclosing directory's perms.
+#
+#  Re-triggered automatically whenever this script body changes (chezmoi
+#  hashes the body). Runs on all OSes (no os_family gate).
+#
+#  Covered files:
+#    zai.key      — Z.ai API key (literal, 1 line)
+#    .env         — provider API keys (ANTHROPIC/OPENAI/... when populated)
+#    models.yml   — literal zai-coding provider key in apiKey:
+# =============================================================================
+set -euo pipefail
+
+SECRETS_DIR="${HOME}/.omp/agent"
+declare -a SECRET_FILES=("zai.key" ".env" "models.yml")
+
+log() { printf '\033[1;34m[omp-secret-perms]\033[0m %s\n' "$*"; }
+
+if [[ ! -d "$SECRETS_DIR" ]]; then
+    log "~/.omp/agent not present on this box (omp not installed?) — skipping"
+    exit 0
+fi
+
+fixed=0
+for f in "${SECRET_FILES[@]}"; do
+    path="${SECRETS_DIR}/${f}"
+    if [[ ! -f "$path" ]]; then
+        log "${f}: not present — skipping"
+        continue
+    fi
+    current_perm=$(stat -c '%a' "$path")
+    if [[ "$current_perm" == "600" ]]; then
+        log "${f}: already 600 — nothing to do"
+        continue
+    fi
+    log "${f}: perm is ${current_perm}, fixing to 600"
+    chmod 600 "$path"
+    log "${f}: perm now $(stat -c '%a' "$path")"
+    fixed=$((fixed + 1))
+done
+
+log "done (${fixed} file(s) changed)"