diff --git a/docs/docgen.nix b/docs/docgen.nix
index b640add..f75cce0 100644
--- a/docs/docgen.nix
+++ b/docs/docgen.nix
@@ -96,6 +96,7 @@ stdenvNoCC.mkDerivation {
           [Introduction](README.md)
 
           - [Features]()
+            - [Evaluation time secrets](evalSecrets.md)
             - [Documentation generation](docGen.md)
 
         ''
diff --git a/docs/src/evalSecrets.md b/docs/src/evalSecrets.md
new file mode 100644
index 0000000..2b76061
--- /dev/null
+++ b/docs/src/evalSecrets.md
@@ -0,0 +1,9 @@
+# Evaluation time secrets
+
+Some secrets cannot be left in cleartext (e.g time zone, user's real names), but are required at evaluation time,
+and in some cases using sops-nix's template is really inconvenient.
+To handle this, __currently__ i use strange approach: I manually encrypt files with sops, commit them and manually decrypt.
+[git-agecrypt](https://github.com/vlaci/git-agecrypt) wasn't suitable for me.
+In future, i will replace it with my own implementation of transparent git encryption based on sops.
+
+Also, this used only for secrets which may be safely left in world-readable store. For more sensitive secrets I use `sops-nix`, which decrypts secrets only at runtime.
\ No newline at end of file