diff --git a/direnv/.config/direnv/direnv.toml b/direnv/.config/direnv/direnv.toml
index 89ac394..695a232 100644
--- a/direnv/.config/direnv/direnv.toml
+++ b/direnv/.config/direnv/direnv.toml
@@ -1,2 +1,2 @@
 [global]
-load_dotenv = true
+load_dotenv = false
diff --git a/direnv/.config/direnv/direnvrc b/direnv/.config/direnv/direnvrc
new file mode 100644
index 0000000..df319ab
--- /dev/null
+++ b/direnv/.config/direnv/direnvrc
@@ -0,0 +1,15 @@
+export_secret() {
+    local name="$1"
+    local file="/run/secrets/${name}"
+
+    if [[ ! -f "$file" ]]; then
+        printf "secret file not found: %s\n" $file >&2
+        return 1
+    fi
+
+    # Read first line, remove trailing spaces/tabs, convert nulls to newlines
+    local value
+    value=$(head -n1 "$file" | sed 's/[ \t]*$//' | tr '\0' '\n')
+
+    export "${name}=${value}"
+}