diff --git a/.gitsecret/paths/mapping.cfg b/.gitsecret/paths/mapping.cfg
index 2f89bb552..fda2c84fb 100644
--- a/.gitsecret/paths/mapping.cfg
+++ b/.gitsecret/paths/mapping.cfg
@@ -1 +1 @@
-secrets.json:9e05ae88de0df720ecc712b8e6bded3301bfd890cd13d0fb34d83bd37d14b594
+secrets.json:7d596a3ed16403040d89dd7e033a2af58e7aaabb6f246f44751b80a1863a2949
diff --git a/secrets.json.secret b/secrets.json.secret
index 9c3883238..d4c02bf69 100644
Binary files a/secrets.json.secret and b/secrets.json.secret differ
diff --git a/tools/monzo_ynab/.envrc b/tools/monzo_ynab/.envrc
index 9b2344773..f368d0b7e 100644
--- a/tools/monzo_ynab/.envrc
+++ b/tools/monzo_ynab/.envrc
@@ -1,8 +1,8 @@
 source_up
 use_nix
-export monzo_client_id="$(pass show finance/monzo/client-id)"
-export monzo_client_secret="$(pass show finance/monzo/client-secret)"
-export ynab_personal_access_token="$(pass show finance/youneedabudget.com/personal-access-token)"
-export ynab_account_id="$(pass show finance/youneedabudget.com/personal-access-token)"
-export ynab_budget_id="$(pass show finance/youneedabudget.com/budget-id)"
+export monzo_client_id="$(jq -j '.monzo | .clientId' < ~/briefcase/secrets.json)"
+export monzo_client_secret="$(jq -j '.monzo | .clientSecret' < ~/briefcase/secrets.json)"
+export ynab_personal_access_token="$(jq -j '.ynab | .personalAccessToken' < ~/briefcase/secrets.json)"
+export ynab_account_id="$(jq -j '.ynab | .accountId' < ~/briefcase/secrets.json)"
+export ynab_budget_id="$(jq -j '.ynab | .budgetId' < ~/briefcase/secrets.json)"
 export store_path="$(pwd)"
diff --git a/website/sandbox/contentful/.envrc b/website/sandbox/contentful/.envrc
index 98e1d2c82..848d74e8b 100644
--- a/website/sandbox/contentful/.envrc
+++ b/website/sandbox/contentful/.envrc
@@ -1,4 +1,4 @@
 source_up
 use_nix
-export CONTENTFUL_SPACE_ID="$(pass show programming/contentful/space-id)"
-export CONTENTFUL_ACCESS_TOKEN="$(pass show programming/contentful/access-token)"
+export CONTENTFUL_SPACE_ID="$(jq -j '.contentful | .spaceId' < ~/briefcase/secrets.json)"
+export CONTENTFUL_ACCESS_TOKEN="$(jq -j '.contentful | .accessToken' < ~/briefcase/secrets.json)"
diff --git a/website/sandbox/learnpianochords/src/server/.envrc b/website/sandbox/learnpianochords/src/server/.envrc
new file mode 100644
index 000000000..db08eac38
--- /dev/null
+++ b/website/sandbox/learnpianochords/src/server/.envrc
@@ -0,0 +1,6 @@
+source_up
+use_nix
+export SERVER_PORT=3000
+export CLIENT_PORT=8000
+export GOOGLE_CLIENT_ID="$(jq -j '.google | .clientId' < ~/briefcase/secrets.json)"
+export STRIPE_API_KEY="$(jq -j '.stripe | .apiKey' < ~/briefcase/secrets.json)"