{
  flake.modules.homeManager.onepassword = { pkgs, lib, ... }: {
    programs._1password-shell-plugins = {
      # enable 1Password shell plugins for bash, zsh, and fish shell
      enable = true;
      # the specified packages as well as 1Password CLI will be
      # automatically installed and configured to use shell plugins
      # https://developer.1password.com/docs/cli/shell-plugins
      plugins = with pkgs; [ gh ];
    };

    home.file.".config/1Password/ssh/agent.toml".text = ''
      # https://developer.1password.com/docs/ssh/agent/config
      [[ssh-keys]]
      vault = "Private"
    '';
    programs.ssh = {
      enable = true;
      extraConfig = ''
        Host *
            IdentityAgent ${config.home.homeDirectory}/.1password/agent.sock
      '';
    };
  };
}