diff --git a/src/servala/core/migrations/0004_encrypt_api_credentials.py b/src/servala/core/migrations/0004_encrypt_api_credentials.py
new file mode 100644
index 0000000..9ca4acf
--- /dev/null
+++ b/src/servala/core/migrations/0004_encrypt_api_credentials.py
@@ -0,0 +1,46 @@
+# Generated by Django 5.2b1 on 2025-03-24 06:33
+
+import encrypted_fields.fields
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("auth", "0012_alter_user_first_name_max_length"),
+        ("core", "0003_billing_entity_nullable"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="groups",
+            field=models.ManyToManyField(
+                blank=True,
+                help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
+                related_name="user_set",
+                related_query_name="user",
+                to="auth.group",
+                verbose_name="groups",
+            ),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="user_permissions",
+            field=models.ManyToManyField(
+                blank=True,
+                help_text="Specific permissions for this user.",
+                related_name="user_set",
+                related_query_name="user",
+                to="auth.permission",
+                verbose_name="user permissions",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="controlplane",
+            name="api_credentials",
+            field=encrypted_fields.fields.EncryptedJSONField(
+                verbose_name="API credentials"
+            ),
+        ),
+    ]
diff --git a/src/servala/core/models/service.py b/src/servala/core/models/service.py
index acf366b..83cc696 100644
--- a/src/servala/core/models/service.py
+++ b/src/servala/core/models/service.py
@@ -1,5 +1,6 @@
 from django.db import models
 from django.utils.translation import gettext_lazy as _
+from encrypted_fields.fields import EncryptedJSONField
 
 
 class ServiceCategory(models.Model):
@@ -67,7 +68,7 @@ class ControlPlane(models.Model):
     description = models.TextField(blank=True, verbose_name=_("Description"))
     k8s_api_endpoint = models.URLField(verbose_name=_("Kubernetes API endpoint"))
     # TODO: schema
-    api_credentials = models.JSONField(verbose_name=_("API credentials"))
+    api_credentials = EncryptedJSONField(verbose_name=_("API credentials"))
 
     cloud_provider = models.ForeignKey(
         to="CloudProvider",