diff --git a/deploy/README.md b/deploy/README.md
index 5567a86e..d47cc809 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -1,7 +1,8 @@
 # `colmena` deployments
 
-* tags: `local`, `cloud`
+* tags: `personal`, `lab`
 * deployments can be made from `astyanax` and `andromache` hosts
+* `hecuba` uses `deploy-rs` instead of `colmena` (see `./deploy-rs.nix`)
 
 ## References
 
diff --git a/flake.lock b/flake.lock
index c78e4d92..ace73c08 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,27 @@
 {
   "nodes": {
+    "arion": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "haskell-flake": "haskell-flake",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770259557,
+        "narHash": "sha256-EvZ09k9+mzXAngPzU2K7oLLUDlKoT1numb4bDb3Gtl4=",
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "rev": "9b24cf65c72cb0e9616e437d55e1ac8e5c6bc715",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "type": "github"
+      }
+    },
     "base16": {
       "inputs": {
         "fromYaml": "fromYaml"
@@ -224,17 +246,16 @@
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
-          "nvim",
-          "mcp-hub",
+          "arion",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
         "type": "github"
       },
       "original": {
@@ -244,6 +265,27 @@
       }
     },
     "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "arion",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -354,6 +396,39 @@
         "type": "github"
       }
     },
+    "haskell-flake": {
+      "locked": {
+        "lastModified": 1675296942,
+        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "ref": "0.1.0",
+        "repo": "haskell-flake",
+        "type": "github"
+      }
+    },
+    "hecuba-services": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783879508,
+        "narHash": "sha256-iVzLmKGet/kmKniaFD2ICyPGnxVAOlQmmNElUDfWcns=",
+        "ref": "main",
+        "rev": "1b2960706ebaa6e271c80273f00f65fda3027127",
+        "revCount": 28,
+        "type": "git",
+        "url": "ssh://git@github.com/hektor/hecuba-services"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://git@github.com/hektor/hecuba-services"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -376,7 +451,7 @@
     },
     "mcp-hub": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
@@ -417,10 +492,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1778944969,
-        "narHash": "sha256-wT4WiBUqfeajcaOWvSKmHGKXEGmnDVQsRg0v7NoZW5o=",
+        "lastModified": 1783872092,
+        "narHash": "sha256-Lg4kvJw3BxjeBEszQ9n1H+Oj/30u3N9N+TAwbmKhDPY=",
         "ref": "main",
-        "rev": "aae027d8de9ae66ea29c9e6a5ff6ea0f4b735261",
+        "rev": "1900322e9ddd920986c5b31ef161fd1c3f977846",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -679,11 +754,13 @@
     },
     "root": {
       "inputs": {
+        "arion": "arion",
         "colmena": "colmena",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
+        "hecuba-services": "hecuba-services",
         "home-manager": "home-manager",
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
@@ -737,7 +814,7 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
diff --git a/flake.nix b/flake.nix
index adc76513..f1ffdcc1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,6 +26,14 @@
       url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    arion = {
+      url = "github:hercules-ci/arion";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    hecuba-services = {
+      url = "git+ssh://git@github.com/hektor/hecuba-services?ref=main";
+      flake = false;
+    };
     git-hooks = {
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/hosts/hecuba/default.nix b/hosts/hecuba/default.nix
index f738ac5d..1ae0d526 100644
--- a/hosts/hecuba/default.nix
+++ b/hosts/hecuba/default.nix
@@ -14,6 +14,8 @@ in
   imports = [
     inputs.disko.nixosModules.disko
     "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
+    inputs.arion.nixosModules.arion
+    "${inputs.hecuba-services}"
     ../../modules
   ];
 
@@ -22,9 +24,12 @@ in
   hardware.facter.reportPath = ./facter.json;
 
   docker.enable = true;
+  secrets.enable = true;
   ssh.enable = true;
   tailscale.enable = true;
 
+  virtualisation.arion.backend = "docker";
+
   networking.hostName = config.host.name;
 
   fileSystems."/" = {