diff --git a/modules/cli/default.nix b/modules/cli/default.nix
index 6804cfa..b8dbc18 100644
--- a/modules/cli/default.nix
+++ b/modules/cli/default.nix
@@ -47,6 +47,10 @@
         "doas nixos-rebuild dry-activate --flake ~/.dotfiles --recreate-lock-file";
 
       emacs = editor;
+
+      nixpkgs-pr = "nixpkgs-review pr --token ${
+          if (config.modules.cli.shell.name == "fish") then "" else "$"
+        }(cat /run/agenix/github)";
     };
     variables = { EDITOR = editor; };
   };
@@ -75,6 +79,7 @@
 
       # utility
       cht-sh
+      nixpkgs-review
     ];
     programs = {
       bat.enable = true;
@@ -85,4 +90,10 @@
       starship.enable = true;
     };
   };
+  age.secrets = {
+    github = {
+      file = ../../secrets/github.age;
+      owner = "1000";
+    };
+  };
 }
diff --git a/secrets/github.age b/secrets/github.age
new file mode 100644
index 0000000..cb33ba5
--- /dev/null
+++ b/secrets/github.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 CjuqfA 2cUy/OCKcnE15PdDK+YV3/G7TxRrkVqR+jKOOJVI3AE
+Pfh3VfL255OTYrEk6giqpS4niTZeJG1kAFo7d/a4NVs
+-> ssh-ed25519 wG6LYg UrwkJ/PJArkY7sQ7UMXF4AYmPMKeMn+X8fAPbFI1QCg
+j9P8pfqk8nYveQTbssrKJnZxCKNqkg5LU8FLQBx4DgE
+-> ssh-ed25519 ZYd7Zg Jj7h2ilZlRlBis0HNYZLMy4kWavr/YJcxyY1K77SowI
+vGi4pUffAXMAfhCT9lDrJPHSFVuy6VLHbsqW+hU3l3A
+-> pM{wDhj-grease !MO$KPPv iF ]Hmdi66O d'w;
+WKw1ETX/Su06prpM2ZrtN2Jyhkqz+fOeogFmboxmnyd6T/fYNI4Jtf8TK1CSWRav
+IojJzwMtGHoi3YtQt37L00NRCOpFKpE
+--- OGbf0wroLDq7rcxIcV4hQizVnAtL+yCcWZjCLPeW/LI
+«ÉKÁe%hN0naÂœ•gëÜkã¹Q–$WÎSXÖ³Ó¡É˧ÿˆ6¢¬t~‚ÒÙ?ÀeTMæøÊ
ß©J¦–@‰åÓ{ySLŽ(
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 70a7298..4f37324 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -15,4 +15,5 @@ in {
   "email-laptop.age".publicKeys = users ++ hosts;
   "home-vpn.age".publicKeys = users ++ hosts;
   "home-vpn-password.age".publicKeys = users ++ hosts;
+  "github.age".publicKeys = users ++ hosts;
 }