diff --git a/.gitignore b/.gitignore
index 9ab2214..aa6016e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -150,3 +150,4 @@ override.tf.json
 # End of https://www.gitignore.io/api/terraform
 
 terraform/secrets.auto.tfvars
+terraform/secrets.sh
diff --git a/scripts/terraform-apply.sh b/scripts/terraform-apply.sh
index 0023776..fc39343 100755
--- a/scripts/terraform-apply.sh
+++ b/scripts/terraform-apply.sh
@@ -4,4 +4,6 @@ set -ex
 
 cd terraform/
 
+source secrets.sh
+
 terraform apply
diff --git a/scripts/terraform-plan.sh b/scripts/terraform-plan.sh
index a1ec465..c5d86d5 100755
--- a/scripts/terraform-plan.sh
+++ b/scripts/terraform-plan.sh
@@ -4,4 +4,6 @@ set -ex
 
 cd terraform/
 
+source secrets.sh
+
 terraform plan
diff --git a/terraform/backends.tf b/terraform/backends.tf
new file mode 100644
index 0000000..59a3339
--- /dev/null
+++ b/terraform/backends.tf
@@ -0,0 +1,8 @@
+terraform {
+  backend "s3" {
+    bucket = "0rng-terraform"
+    key    = "terraform.tfstate"
+    encrypt = true
+    region = "eu-west-2"
+  }
+}