diff --git a/home/dot_config/autorestic/autorestic-system.yml.tmpl b/home/dot_config/autorestic/autorestic-system.yml.tmpl
index 00967c30..747df5cc 100644
--- a/home/dot_config/autorestic/autorestic-system.yml.tmpl
+++ b/home/dot_config/autorestic/autorestic-system.yml.tmpl
@@ -54,11 +54,11 @@ backends:
   docker-local:
     type: local
     path: /var/local/backups/docker
-    key: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_SYSTEM_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_SYSTEM_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_SYSTEM_PASSWORD") }}{{ end }}
+    key: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_SYSTEM_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_SYSTEM_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_SYSTEM_PASSWORD") }}{{ end }}
   docker-s3:
     type: s3
     path: {{ .user.cloudflare.r2 }}.r2.cloudflarestorage.com/docker
-    key: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_SYSTEM_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_SYSTEM_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_SYSTEM_PASSWORD") }}{{ end }}
+    key: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_SYSTEM_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_SYSTEM_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_SYSTEM_PASSWORD") }}{{ end }}
     env:
-      AWS_ACCESS_KEY_ID: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_ID")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_ID" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_ID") }}{{ end }}
-      AWS_SECRET_ACCESS_KEY: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_SECRET")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_SECRET" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_SECRET") }}{{ end }}
+      AWS_ACCESS_KEY_ID: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_ID")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_ID" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_ID") }}{{ end }}
+      AWS_SECRET_ACCESS_KEY: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_SECRET")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_SECRET" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_SECRET") }}{{ end }}
diff --git a/home/dot_config/autorestic/autorestic-user.yml.tmpl b/home/dot_config/autorestic/autorestic-user.yml.tmpl
index 21af321b..a43ec17c 100644
--- a/home/dot_config/autorestic/autorestic-user.yml.tmpl
+++ b/home/dot_config/autorestic/autorestic-user.yml.tmpl
@@ -114,22 +114,22 @@ backends:
   apps-local:
     type: local
     path: /var/local/backups/user/{{ .user.username }}/apps
-    key: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
+    key: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
   apps-s3:
     type: s3
     path: {{ .user.cloudflare.r2 }}.r2.cloudflarestorage.com/user/{{ .user.username }}/Backups/apps
-    key: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
+    key: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
     env:
-      AWS_ACCESS_KEY_ID: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_ID_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_ID_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_ID_USER") }}{{ end }}
-      AWS_SECRET_ACCESS_KEY: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_SECRET_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_SECRET_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_SECRET_USER") }}{{ end }}
+      AWS_ACCESS_KEY_ID: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_ID_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_ID_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_ID_USER") }}{{ end }}
+      AWS_SECRET_ACCESS_KEY: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_SECRET_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_SECRET_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_SECRET_USER") }}{{ end }}
   home-local:
     type: local
     path: /var/local/backups/user/{{ .user.username }}/home
-    key: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
+    key: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
   home-s3:
     type: s3
     path: {{ .user.cloudflare.r2 }}.r2.cloudflarestorage.com/user/{{ .user.username }}/Backups/home
-    key: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
+    key: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "RESTIC_PASSWORD")) }}{{ includeTemplate "secrets/RESTIC_PASSWORD" | decrypt | trim }}{{ else }}{{ default "" (env "RESTIC_PASSWORD") }}{{ end }}
     env:
-      AWS_ACCESS_KEY_ID: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_ID_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_ID_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_ID_USER") }}{{ end }}
-      AWS_SECRET_ACCESS_KEY: {{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_SECRET_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_SECRET_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_SECRET_USER") }}{{ end }}
+      AWS_ACCESS_KEY_ID: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_ID_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_ID_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_ID_USER") }}{{ end }}
+      AWS_SECRET_ACCESS_KEY: {{ if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_R2_SECRET_USER")) }}{{ includeTemplate "secrets/CLOUDFLARE_R2_SECRET_USER" | decrypt | trim }}{{ else }}{{ default "" (env "CLOUDFLARE_R2_SECRET_USER") }}{{ end }}