diff --git a/ansible/group_vars/all/secrets.enc.yaml b/ansible/group_vars/all/secrets.enc.yaml
index 1863201..7b566db 100644
--- a/ansible/group_vars/all/secrets.enc.yaml
+++ b/ansible/group_vars/all/secrets.enc.yaml
@@ -1,16 +1,17 @@
-grafana_pagerduty_integration_key: ENC[AES256_GCM,data:eXfaIsRwfqZm5ROIIFpeyuyk4/4wi3M02Bmgl7/SoRk=,iv:4HcB2WTDTrDADwE/ZVK84l6aIxayzz3e7VFZpVNY3Pg=,tag:4mTmfCP9GV9rGY2ALxWhgQ==,type:str]
+grafana_pagerduty_integration_key: ENC[AES256_GCM,data:w5DRzr556lV3sHJLFBNGLqkrblvilK2SO7R0eIK0yus=,iv:n/9UJcBZu3H8HBJ4AGOy59oLsC+rr+1uo/+m14WmANk=,tag:hnpNsSPVjGpO2Bwut3vFJw==,type:str]
+plex_exporter_plex_token: ENC[AES256_GCM,data:o+r95K2PswMe36HFLF5YQE9mgQ==,iv:6YGuqB8mauZ00ay4/IrSmSDLw7r5U3U3LIOBnyARXI8=,tag:OIBKMW0rLUxXiE7BvYGOPg==,type:str]
 sops:
     age:
         - recipient: age1r8uh2w2qad2z5sgq9q7l73962q2sp8zz9hdnh6sjuvanxl565vmswn8squ
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSFY2QWdpZ3lUUTZDYk5F
-            MVFyMy9rOG1ZejlrQUxPWjFpTlZpS2w1dHlVCmg4VkpYTmhYUk42ZytpOUJ5czg5
-            VmJUQ2VJKzNtdWhiUGhTTVhndmplWG8KLS0tIHhKWkpWVG5CcnI0NkNwWGRCMDM5
-            QVRncWVjR25sR0ViY1pCWkFXYVRURFUKyknDYVq9Bzo3Bdi4/dl3Ryj3qkLiGhrW
-            hlRDiPyTWfMPwffF3SmKCrI60b+Y0QhkZ+/Wym4JuuW1TKQERv4lhw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0MjJKcnVGTlRFRjFLVThy
+            SkJXK0hMSlBoOEdFZVVlN0QrUEdTS3ppdWhBCm4wN1A4ZW95RGtaMTh0dW8ydW5T
+            cG9qNjFkaFhaYjVqbXJhcVVGZGF0R2MKLS0tIG5DMWhlVVN4dzFxc3Avckh5VEl0
+            SVRabjA0a09CbWFnK0VXbC91aGdtTTAK7Y/qaIxV6TkoqL8IZF/Hc4f0YHa9jVx9
+            9X+LJbLK2wMNd9TUjpDvbMty+WIcZmL7y/B7r6Cs3640mWEsQO0wAA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-25T19:50:39Z"
-    mac: ENC[AES256_GCM,data:EFguQ9aY0I+y0WEkJCAA19uuRtquZVHdRBTjjGr2BoeVrq16iu1dIeZOH3eMj/b1MvI1NF7DoLJEUsxKZDS2YeTsBF46oOmc0VErR7w1BIlET8FhQANhqtPF0OglwYD5gCsxXjbx25TLfOpP4iHPwLY440Gk3BtWR1TMObD4C+c=,iv:/ncyoPfWMjeCSWI4Hfv1Tm5rRH0+ytT3OBlKNyy7k+I=,tag:VYyCwmBTfBHWF9ICZz7kSg==,type:str]
+    lastmodified: "2026-04-12T20:09:02Z"
+    mac: ENC[AES256_GCM,data:wBRxvdA8TtnrZMNgxd42Kt61Eq7gnvYFXDJwRep1ioz7RChvmnm+4pniuN4zTmX9QfKAdmDd4Yp91rLuRstnhT/s81P6qwypF0l6VnA7AZ/PkOFhpe9TzY/f+oxYceIiT/bHDqGqOpGNFop7yVvjRam0FzjVxT+DzwoRhPqfII0=,iv:EAXvhNIHcgbq7XiVmLC6cT5o/buYB2cnn3cUJmCrRzI=,tag:VnVKHu2oETH04QvtgT5/pQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2
diff --git a/ansible/roles/docker_services/tasks/main.yml b/ansible/roles/docker_services/tasks/main.yml
index 5d9555e..fbc46de 100644
--- a/ansible/roles/docker_services/tasks/main.yml
+++ b/ansible/roles/docker_services/tasks/main.yml
@@ -22,6 +22,16 @@
   loop: "{{ docker_services | default([]) }}"
   failed_when: false
 
+- name: Template service .env files
+  ansible.builtin.template:
+    src: "{{ playbook_dir }}/services/{{ item }}/.env.j2"
+    dest: "/opt/docker/{{ item }}/.env"
+    mode: '0600'
+  loop: "{{ docker_services | default([]) }}"
+  when: lookup('ansible.builtin.fileglob', playbook_dir + '/services/' + item + '/.env.j2') | length > 0
+  no_log: true
+  failed_when: false
+
 - name: Start/update docker compose services
   community.docker.docker_compose_v2:
     project_src: "/opt/docker/{{ item.item }}"
diff --git a/ansible/services/plex-exporter/.env.j2 b/ansible/services/plex-exporter/.env.j2
new file mode 100644
index 0000000..e614496
--- /dev/null
+++ b/ansible/services/plex-exporter/.env.j2
@@ -0,0 +1 @@
+PLEX_TOKEN={{ plex_exporter_plex_token }}