diff --git a/DOCKER_HUB.md b/DOCKER_HUB.md
index aca35db..7356e02 100644
--- a/DOCKER_HUB.md
+++ b/DOCKER_HUB.md
@@ -454,7 +454,7 @@ docker compose run --rm devbox bash   # interactive shell
 - **opencode** — AI coding assistant
 - **Node.js 22** — for npx-based MCP servers
 - **AWS CLI v2** — SSO and Bedrock authentication
-- **Dev tools** — git, git-lfs, ssh, ripgrep, fd, fzf, bat, eza, zoxide, uv, rustup, jq, make, curl, wget, neovim 0.12, tmux, htop, tree
+- **Dev tools** — git, git-lfs, git-crypt, age, ssh, ripgrep, fd, fzf, bat, eza, zoxide, uv, rustup, jq, make, curl, wget, neovim 0.12, tmux, htop, tree
 - **Non-root user** — runs as `developer` with UID auto-matched to workspace owner (sudo available)
 
 ### OMOS image (`latest-omos`)
diff --git a/Dockerfile b/Dockerfile
index e1751ae..72133e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,6 +32,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     make \
     patch \
     diffutils \
+    git-crypt \
+    age \
     sudo \
     locales \
     procps \
diff --git a/README.md b/README.md
index b6b5a06..4e7e882 100644
--- a/README.md
+++ b/README.md
@@ -478,7 +478,7 @@ Container (Debian trixie)
 ├── oh-my-opencode-slim (optional — multi-agent orchestration plugin, includes Bun)
 ├── AWS CLI v2 (SSO + Bedrock auth)
 ├── neovim 0.12, tmux, htop, bat, eza, zoxide, uv, rustup, make
-├── git, ssh, ripgrep, fd, fzf, jq, curl, tree
+├── git, git-crypt, age, ssh, ripgrep, fd, fzf, jq, curl, tree
 ├── Node.js (for MCP servers)
 ├── Bun (optional — included with oh-my-opencode-slim)
 ├── entrypoint.sh (UID adjustment, git config, provider setup)