diff --git a/docs/todo.md b/docs/todo.md
index 3abcaf43..bf80a4b2 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,5 +1,6 @@
 # TODO
 
+- [(bug) Fix wireguard secrets](../apps/resources/wireguard.yaml#L17)
 - [(feature) Add lint checks for everything](../Makefile#L29)
 - [(feature) Simple script to backup everything](../scripts/backup.sh#L3)
 - [(feature) Simple script to restore everything](../scripts/restore.sh#L3)
diff --git a/tools/Dockerfile b/tools/Dockerfile
index e80ab13f..68be9a19 100644
--- a/tools/Dockerfile
+++ b/tools/Dockerfile
@@ -16,4 +16,7 @@ RUN yes | pacman --sync --refresh \
         p7zip \
         python \
         python-netaddr \
-        terraform
+        terraform \
+        zsh
+
+CMD [ "/bin/zsh" ]
diff --git a/tools/Makefile b/tools/Makefile
index d86b1e40..e3616eab 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -1,13 +1,11 @@
 .POSIX:
 
-WORKDIR = /usr/local/src
 TAG = homelab-tools
 
 default: build run
 
 build:
-	docker build . \
-		--tag ${TAG}
+	docker build . --tag ${TAG}
 
 run:
 	docker run \
@@ -16,8 +14,8 @@ run:
 		--tty \
 		--network host \
 		--env "TERM=${TERM}" \
-		--volume "$(shell pwd)/..:${WORKDIR}" \
-		--volume "${HOME}/.ssh/id_ed25519.pub:/root/.ssh/id_ed25519.pub" \
+		--env "HOME=${HOME}" \
+		--volume "${HOME}:${HOME}" \
 		--volume "/var/run/docker.sock:/var/run/docker.sock" \
-		--workdir "${WORKDIR}" \
+		--workdir "$(shell pwd)/.." \
 		${TAG}