diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ebb2af..a5fdecb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@
 
 ## Features
 
+- Add CNAME record for envshare ([5178fc6](https://github.com/noclocks/dns/commit/5178fc6b36cbd4b43bd8485dd12c90f711709859))  - (Jimmy Briggs)
 - Add envshare sub-domain vercel verification ([ce2d04a](https://github.com/noclocks/dns/commit/ce2d04a3c2802da6ea513408321b333e8d2ca852))  - (Jimmy Briggs)
 - Temporary `CNAME` for `bastien` subdomain ([2a0e7e2](https://github.com/noclocks/dns/commit/2a0e7e2f28604b2f79e79449bf45f30cdf19342a))  - (Patrick Howard)
 - Add CNAME records for google workspace tools ([13f59c5](https://github.com/noclocks/dns/commit/13f59c588b53946e4394b3a29c0096d81fc49b0f))  - (Jimmy Briggs)
diff --git a/dnsconfig.js b/dnsconfig.js
index 3d16cae..c560c92 100644
--- a/dnsconfig.js
+++ b/dnsconfig.js
@@ -33,6 +33,7 @@ D("noclocks.dev", REG_NONE
 	, CNAME("gsites", "ghs.googlehosted.com.")
 	, CNAME("bastien", "ghs.googlehosted.com.")
 	, CNAME("envshare", "cname.vercel-dns.com.")
+  , CNAME("secrets", "fnj6wg3o.up.railway.app.")
 	, MX("@", 1, "smtp.google.com.")
 	, TXT("@", "stripe-verification=89f4a41b52e121c2857c7989fa0edea55106bec6c43be66692ce13c3fd826707")
 	, TXT("google._domainkey", "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnxb49YRvvMIjYWCEkGS8uRyi2jFfJYwuA4/b59aMAraFcJjeB+Xx6MvhAVpCe2/Zh/QGPtaAFbsluKJPTzW4qnddz85WVurrdIhxgVeyr417kPlYu1t8GbGQ1MQ53J4cPxs3x7beCLNbfXOF16o3wektAKb9Ap9oEioFysB9ingRLju+xGzpCii3vSFeDbYBYnheSzgPpo7fw5eQbnEN8iHu1XUQCunSxC0pOD8dWdM6pgXZ2UR3zehE+jjwtlNgz216+wUVn5E1CELk4fPqbMM0lhXFBUyAceH0sx4Zbo09ix74cOU34OlNxvdCUgQYNYCEBe7psW9hesbSiev8twIDAQAB")