diff --git a/bucket/secretspec.json b/bucket/secretspec.json
new file mode 100644
index 0000000000000..23a03c18bb282
--- /dev/null
+++ b/bucket/secretspec.json
@@ -0,0 +1,33 @@
+{
+    "version": "0.19.1",
+    "description": "A declarative interface for every secret provider.",
+    "homepage": "https://secretspec.dev",
+    "license": "Apache-2.0",
+    "architecture": {
+        "64bit": {
+            "url": "https://github.com/cachix/secretspec/releases/download/v0.19.1/secretspec-x86_64-pc-windows-msvc.zip",
+            "hash": "563bf248bdbeac90cacc9c8706ca11d16504947b91a132632c45285dc80d4f75"
+        },
+        "arm64": {
+            "url": "https://github.com/cachix/secretspec/releases/download/v0.19.1/secretspec-aarch64-pc-windows-msvc.zip",
+            "hash": "d86b2ebd293df1274df9de5b86f5524f55aa6767b523eca86200b079e87141b6"
+        }
+    },
+    "bin": "secretspec.exe",
+    "checkver": {
+        "github": "https://github.com/cachix/secretspec"
+    },
+    "autoupdate": {
+        "architecture": {
+            "64bit": {
+                "url": "https://github.com/cachix/secretspec/releases/download/v$version/secretspec-x86_64-pc-windows-msvc.zip"
+            },
+            "arm64": {
+                "url": "https://github.com/cachix/secretspec/releases/download/v$version/secretspec-aarch64-pc-windows-msvc.zip"
+            }
+        },
+        "hash": {
+            "url": "$url.sha256"
+        }
+    }
+}