diff --git a/env/smbcredentials.gpg b/env/smbcredentials.gpg
new file mode 100644
index 0000000..af6111c
--- /dev/null
+++ b/env/smbcredentials.gpg
@@ -0,0 +1,9 @@
+-----BEGIN PGP MESSAGE-----
+
+hF4DAAAAAAAAAAASAQdAvYM4C8bwyey5d33bXjxKnWe0dIsnk0j5KTpe3TzrLHUw
+xWF1m3TwpgyRA6LiRHukJ9McoNwRQ7xCdp6XSF+7crNBQWj64/fm1fVymBcv5EkK
+0ngBJ3I46PcNoVfjCh+1PmSzHFh3ahLU8u95FCL+IbvIrD0DdzntdNAthFSaiHuH
+DrXiHhGkxuRj0UHi95DF3xi6ODrvC56xTg1jWKzzB+/LuZ6GKSPYd3u/iYmPn76y
+wiFck8SezOvP0o71tcLa56SQgzSBiDTHL3A=
+=8OSr
+-----END PGP MESSAGE-----
diff --git a/runs/after/system b/runs/after/system
index 1bcf56b..4093cfa 100755
--- a/runs/after/system
+++ b/runs/after/system
@@ -8,25 +8,29 @@ set -o pipefail
 # installed yet.
 SCRIPTS="${DEV_ENV}/env/.local/scripts"
 
+_ensure_mount() {
+	local line=${1:-""}
+	local mount=${2:-""}
+	if [[ -n $line ]] && [[ -d $mount ]]; then
+		if sudo cat /etc/fstab | grep -vq "$line"; then
+			log "	Setting up nas mount."
+			# sudo mkdir -p $mount &>/dev/null
+			echo "$line" | sudo tee --append /etc/fstab
+			sudo systemctl daemon-reload
+			sudo mount -a ||
+				log --warning "You will need to make sure this computer's ip is in the allow list, then run 'sudo mount -a'"
+		fi
+	fi
+}
+
 _setup-mounts() {
-	local line="nas.housh.dev:/var/nfs/shared/michael_share /mnt/michael nfs defaults 0 0"
-	if sudo cat /etc/fstab | grep -vq "$line"; then
-		log "	Setting up nas mount."
-		sudo mkdir -p /mnt/michael &>/dev/null
-		echo "$line" | sudo tee --append /etc/fstab
-		sudo systemctl daemon-reload
-		sudo mount -a ||
-			log --warning "You will need to make sure this computer's ip is in the allow list, then run 'sudo mount -a'"
-	fi
-	line="nas.housh.dev:/var/nfs/shared/Customer_Share /mnt/customers nfs defaults 0 0"
-	if sudo cat /etc/fstab | grep -vq "$line"; then
-		log "	Setting up nas mount."
-		sudo mkdir -p /mnt/customers &>/dev/null
-		echo "$line" | sudo tee --append /etc/fstab
-		sudo systemctl daemon-reload
-		sudo mount -a ||
-			log --warning "You will need to make sure this computer's ip is in the allow list, then run 'sudo mount -a'"
-	fi
+
+	sudo mkdir -p /mnt/{michael,customers} &>/dev/null
+	mkdir -p "$HOME/work" &>/dev/null
+
+	_ensure_mount "nas.housh.dev:/var/nfs/shared/michael_share /mnt/michael nfs defaults 0 0" /mnt/michael
+	_ensure_mount "//nas.housh.dev/michael_share/work $HOME/work cifs credentials=$HOME/.config/.smbcredentials,uid=$(id -u),gid=$(id -g),iocharset=utf8 0 0" "$HOME/work"
+	_ensure_mount "nas.housh.dev:/var/nfs/shared/Customer_Share /mnt/customers nfs defaults 0 0" /mnt/customers
 }
 
 _setup-kanata() {
@@ -65,7 +69,9 @@ _setup-home-dir() {
 	log "	Setting up home directory."
 	rm -rf "$HOME/Desktop" &>/dev/null
 	mkdir "$HOME/{containers,dev}" &>/dev/null
-	mkdir -p "$HOME/work/consults" &>/dev/null
+	mkdir -p "$HOME/work" &>/dev/null
+	gpg --decrypt --output "$HOME/.config/.smbcredentials" "$DEV_ENV/env/smbcredentials.gpg"
+	chmod 600 "$HOME/.config/.smbcredentials"
 }
 
 install() {
diff --git a/runs/system b/runs/system
index 95d4b6a..a612c29 100644
--- a/runs/system
+++ b/runs/system
@@ -1,5 +1,6 @@
 # Packages to install / uninstall with this run
 catppuccin-gtk-theme-mocha
+cifs-utils
 kanata
 nwg-look
 wl-clipboard