diff --git a/hosts/nix-cache/host.nix b/hosts/nix-cache/host.nix
index 53188f2..44146eb 100644
--- a/hosts/nix-cache/host.nix
+++ b/hosts/nix-cache/host.nix
@@ -1,19 +1,19 @@
-{ config, vars, ... }:
+{ vars, ... }:
 
 {
-  networking.hostName = vars.nixCacheHost;
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "nix-cache";
+      sopsFile = ../../secrets/nix-cache.yaml;
+    })
+  ];
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
-  sops.templates."nix-cache-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
+  networking.hostName = vars.nixCacheHost;
 
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;
 
   # Preserved from the pre-refactor `nix-cache` target — stateVersion must
   # never be bumped on an already-installed machine.
diff --git a/hosts/server/host.nix b/hosts/server/host.nix
index e725cab..2e9089d 100644
--- a/hosts/server/host.nix
+++ b/hosts/server/host.nix
@@ -1,22 +1,22 @@
-{ config, vars, ... }:
+{ vars, ... }:
 
 {
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "server";
+      sopsFile = ../../secrets/server.yaml;
+    })
+  ];
+
   networking.hostName = vars.nfsServerHost;
   networking.hostId = "6689f93e";
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
-  sops.templates."server-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
-
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
     EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes";
     LOG_LEVEL = "debug";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;
 
   # Preserved from the pre-refactor `server` target — stateVersion must never
   # be bumped on an already-installed machine.
diff --git a/modules/beszel/host-token.nix b/modules/beszel/host-token.nix
new file mode 100644
index 0000000..5339b4b
--- /dev/null
+++ b/modules/beszel/host-token.nix
@@ -0,0 +1,11 @@
+{ name, sopsFile }:
+
+{ config, ... }:
+
+{
+  sops.secrets."beszel-token".sopsFile = sopsFile;
+  sops.templates."${name}-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+  services.beszel.agent.environmentFile = config.sops.templates."${name}-beszel.env".path;
+}