diff --git a/.gitignore b/.gitignore
index 8b25fa7..c491e9b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,6 @@ result-*
 id_*
 age-keys.txt
 keys.txt
+
+# local env (PATH etc.)
+.env
diff --git a/deploy b/scripts/deploy
similarity index 94%
rename from deploy
rename to scripts/deploy
index b3f6860..e0a03a7 100755
--- a/deploy
+++ b/scripts/deploy
@@ -17,7 +17,9 @@
 # Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`).
 set -euo pipefail
 
-REPO="$(cd "$(dirname "$0")" && pwd)"
+# Locate the repo root (flake dir) regardless of where this script lives on disk.
+SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)"
+REPO="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || dirname "$SCRIPT_DIR")"
 cd "$REPO"
 export PATH="/nix/var/nix/profiles/default/bin:$PATH"
 
diff --git a/edit_secrets b/scripts/edit_secrets
similarity index 84%
rename from edit_secrets
rename to scripts/edit_secrets
index 6e53c8d..d7310a3 100755
--- a/edit_secrets
+++ b/scripts/edit_secrets
@@ -10,8 +10,11 @@
 # (default ~/.config/sops/age/keys.txt). Never commit that key.
 set -euo pipefail
 
-REPO="$(cd "$(dirname "$0")" && pwd)"
+# Locate the repo root (flake dir) regardless of where this script lives on disk.
+SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)"
+REPO="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || dirname "$SCRIPT_DIR")"
 cd "$REPO"
+export PATH="/nix/var/nix/profiles/default/bin:$PATH"
 
 export SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}"
 if [ ! -f "$SOPS_AGE_KEY_FILE" ]; then