diff --git a/flake.lock b/flake.lock
index bb58035..a605e4c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -12,11 +12,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1707830867,
-        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
+        "lastModified": 1703433843,
+        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
+        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
         "type": "github"
       },
       "original": {
@@ -180,11 +180,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1708031129,
-        "narHash": "sha256-EH20hJfNnc1/ODdDVat9B7aKm0B95L3YtkIRwKLvQG8=",
+        "lastModified": 1707683400,
+        "narHash": "sha256-Zc+J3UO1Xpx+NL8UB6woPHyttEy9cXXtm+0uWwzuYDc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3d6791b3897b526c82920a2ab5f61d71985b3cf8",
+        "rev": "21b078306a2ab68748abf72650db313d646cf2ca",
         "type": "github"
       },
       "original": {
@@ -261,11 +261,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1707825078,
-        "narHash": "sha256-hTfge2J2W+42SZ7VHXkf4kjU+qzFqPeC9k66jAUBMHk=",
+        "lastModified": 1706637303,
+        "narHash": "sha256-K6SqE9diWDCoEQ+MzuVlTfNrAKcdIa/dLHBtKfz445U=",
         "owner": "Misterio77",
         "repo": "nix-colors",
-        "rev": "b01f024090d2c4fc3152cd0cf12027a7b8453ba1",
+        "rev": "fc080c51d2a219b40d886870e364243783ed5ca1",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1707956935,
-        "narHash": "sha256-ZL2TrjVsiFNKOYwYQozpbvQSwvtV/3Me7Zwhmdsfyu4=",
+        "lastModified": 1707546158,
+        "narHash": "sha256-nYYJTpzfPMDxI8mzhQsYjIUX+grorqjKEU9Np6Xwy/0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a4d4fe8c5002202493e87ec8dbc91335ff55552c",
+        "rev": "d934204a0f8d9198e1e4515dd6fec76a139c87f0",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 54e1d98..75f6e5a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -94,6 +94,7 @@
               home-manager.users.rouven = {
                 imports = [
                   nix-colors.homeManagerModules.default
+                  agenix.homeManagerModules.default
                 ];
               };
             }
diff --git a/hosts/falkenstein/modules/mail/default.nix b/hosts/falkenstein/modules/mail/default.nix
index c19faa5..dcbcb4e 100644
--- a/hosts/falkenstein/modules/mail/default.nix
+++ b/hosts/falkenstein/modules/mail/default.nix
@@ -34,7 +34,6 @@ in
       enable = true;
       enableSubmission = true;
       enableSubmissions = true;
-      recipientDelimiter = "+";
       hostname = "${hostname}";
       domain = "${domain}";
       origin = "${domain}";
diff --git a/overlays/default.nix b/overlays/default.nix
index 8cda764..08f4b42 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -5,7 +5,6 @@ let
   inherit (prev) fetchPypi;
   inherit (prev) fetchpatch;
   inherit (prev) makeWrapper;
-  inherit (prev) python3Packages;
 in
 rec {
   pcmanfm = prev.pcmanfm.overrideAttrs (_: {
@@ -18,6 +17,23 @@ rec {
   pww = callPackage ../pkgs/pww { };
   ianny = callPackage ../pkgs/ianny { };
 
+  python3 = prev.python3.override {
+    packageOverrides = _finel: prev: {
+      tpm2-pytss = prev.tpm2-pytss.overrideAttrs (old: {
+        # https://github.com/NixOS/nixpkgs/pull/287804/
+        patches = old.patches ++ [
+          (fetchpatch {
+            name = "fix-newer-cryptography-42-0-1-support.patch";
+            url = "https://github.com/tpm2-software/tpm2-pytss/commit/0fbb9d099370c0a7031dd13990986538f586836a.patch";
+            sha256 = "sha256-xnQIr4/iJra0+rn5estVqSvG8pXcuwWykmmayBpCzgw=";
+          })
+
+        ];
+      });
+    };
+
+  };
+  python3Packages = python3.pkgs;
   tpm2-pkcs11 = prev.tpm2-pkcs11.override { fapiSupport = false; };
 
   gnome-break-timer = callPackage ../pkgs/gnome-break-timer { };
diff --git a/secrets.nix b/secrets.nix
index f5a7f64..430d4c8 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -30,4 +30,7 @@ in
   "secrets/falkenstein/wireguard/dorm/preshared.age".publicKeys = [ rouven falkenstein ];
   "secrets/falkenstein/borg/passphrase.age".publicKeys = [ rouven falkenstein ];
   "secrets/falkenstein/borg/key.age".publicKeys = [ rouven falkenstein ];
+
+  # rouven (home manager)
+  "secrets/rouven/spotify.age".publicKeys = [ rouven ];
 }
diff --git a/secrets/rouven/spotify.age b/secrets/rouven/spotify.age
new file mode 100644
index 0000000..19fa7a2
--- /dev/null
+++ b/secrets/rouven/spotify.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 uWbAHQ klzqpl+5gMc23pxP7b6WeMnz0GupktMWsozSgu5qjVI
+zLIUb95/je/M2yGilR2PA5JyO4pG98qSeSa9cBN8oi0
+-> vi>dm(?-grease nUG 4q;
+eFlRMpjidL3vhoL3XhkOfqrdNAV7vBqgsPS5k9NWME2cqK4CcdHNLcyOdQipB2oh
+sMK94/EdKhLC+insD3oR+q6369vB/3oaBayNSUM
+--- De9rDCy3TGRbiGWLSanEwhheglOK8uOHa8Ioga1UjvY
+•9+ð¯Ãæ€pG®“ÑMèi$
±ˆ“;ÊuÆ,DãëE°ÌÚȸ²®¤±Ë
\ No newline at end of file
diff --git a/users/rouven/modules/default.nix b/users/rouven/modules/default.nix
index 8fdb02e..d913806 100644
--- a/users/rouven/modules/default.nix
+++ b/users/rouven/modules/default.nix
@@ -9,6 +9,7 @@
     ./mpv
     # broken
     # ./qutebrowser
+    ./spotify
     ./ssh
     ./theme
     ./tex
diff --git a/users/rouven/modules/git/default.nix b/users/rouven/modules/git/default.nix
index d446667..36aef60 100644
--- a/users/rouven/modules/git/default.nix
+++ b/users/rouven/modules/git/default.nix
@@ -4,31 +4,21 @@
     enable = true;
     userName = "Rouven Seifert";
     userEmail = "rouven@rfive.de";
-    delta = {
-      enable = true;
-      options = {
-        features = "decorations";
+    extraConfig = {
+      core.pager = "${pkgs.delta}/bin/delta";
+      interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
+      delta = {
         navigate = true;
         light = false;
         side-by-side = true;
         line-numbers = true;
       };
-    };
-    extraConfig = {
       merge.conflictStyle = "diff3";
       diff.colorMoved = "default";
       user.signingkey = "B95E8FE6B11C4D09";
       pull.rebase = false;
       init.defaultBranch = "main";
       commit.gpgsign = true;
-      sendemail = {
-        from = "Rouven Seifert <rouven@rfive.de>";
-        smtpEncryption = "ssl";
-        smtpServer = "mail.rfive.de";
-        smteServerPort = 465;
-        smtpSslCertPath = "/etc/ssl/certs/ca-certificates.crt";
-        smtpUser = "rouven";
-      };
     };
   };
   programs.gh = {
diff --git a/users/rouven/modules/spotify/default.nix b/users/rouven/modules/spotify/default.nix
new file mode 100644
index 0000000..84c0ea5
--- /dev/null
+++ b/users/rouven/modules/spotify/default.nix
@@ -0,0 +1,18 @@
+{ config, pkgs, ... }:
+{
+  home.packages = with pkgs;[ spotify-tui ];
+  age.secrets.spotify = {
+    file = ../../../../secrets/rouven/spotify.age;
+  };
+  services.spotifyd = {
+    enable = true;
+    settings = {
+      global = {
+        username = "seifertrouven@gmail.com";
+        password_cmd = "${pkgs.coreutils}/bin/cat ${config.age.secrets.spotify.path}";
+      };
+      backend = "pulseaudio";
+    };
+  };
+  systemd.user.services.spotifyd.Unit.After = [ "agenix.service" ];
+}