diff --git a/__update_sops.sh b/__update_sops.sh
index d53edaa..f1bb860 100755
--- a/__update_sops.sh
+++ b/__update_sops.sh
@@ -23,6 +23,8 @@ function fn_extract_uid(){
   echo "${uid}"
 }
 
+# CAVEAT: dirty hacks, just get it done. Not DRY at all.
+
 echo "# Fingerprint | User Type | User ID"
 for gpgkeyfile in *automation*gpg.pub; do
   u_type="autom"
@@ -33,3 +35,20 @@ for gpgkeyfile in $(ls *gpg.pub | grep -v automation); do
   echo "# $(fn_extract_fpr "${gpgkeyfile}") | ${u_type} | $(fn_extract_uid "${gpgkeyfile}")"
 done
 echo "# keys in https://git.dev-at.de/smardigo-hetzner/communication-keys"
+
+cat <<EOM
+creation_rules:
+  # list of keys for encryption in stage
+  - pgp: >-
+EOM
+for gpgkeyfile in *automation*gpg.pub; do
+  echo "      $(fn_extract_fpr "${gpgkeyfile}"),"
+done
+# all but last line get comma
+for gpgkeyfile in $(ls *gpg.pub | grep -v automation | sed '$d'); do
+  echo "      $(fn_extract_fpr "${gpgkeyfile}"),"
+done
+# last line no comma
+for gpgkeyfile in $(ls *gpg.pub | grep -v automation | tail -n 1); do
+  echo "      $(fn_extract_fpr "${gpgkeyfile}")"
+done