diff --git a/go.mod b/go.mod
index 4bf7a17..15f3157 100644
--- a/go.mod
+++ b/go.mod
@@ -2,9 +2,13 @@ module git.handmadecities.com/HMC/shhh
 
 go 1.27.2
 
-require github.com/spf13/cobra v1.10.2
+require (
+	github.com/spf13/cobra v1.10.2
+	go.etcd.io/bbolt v1.5.0
+)
 
 require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 )
diff --git a/go.sum b/go.sum
index ef5d78d..1f41241 100644
--- a/go.sum
+++ b/go.sum
@@ -1,11 +1,25 @@
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/pkg/secretsstore/bbolt_store.go b/pkg/secretsstore/bbolt_store.go
index 6713885..476ca5c 100644
--- a/pkg/secretsstore/bbolt_store.go
+++ b/pkg/secretsstore/bbolt_store.go
@@ -1,20 +1,89 @@
 package secretsstore
 
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	bolt "go.etcd.io/bbolt"
+)
+
+var boltStoreBucketName []byte = []byte("secrets-store")
+
 // bboltStore implements the SecretsStore interface on top of a bbolt bucket.
 type bboltStore struct {
+	db *bolt.DB
+}
+
+// newBboltStore opens a bolt db at path, creates a default bucket, and uses it
+// as the backing storage for a SecretsStore. Fails if dbpath does not have a
+// `.db` suffix.
+func newBboltStore(dbpath string) (*bboltStore, error) {
+	if !strings.HasSuffix(dbpath, ".db") {
+		return nil, errors.New("store path must end in `.db`")
+	}
+	db, err := bolt.Open(dbpath, 0600, nil)
+	if err != nil {
+		return nil, fmt.Errorf("opening db: %w", err)
+	}
+	// Ensure the default bucket.
+	err = db.Update(func(tx *bolt.Tx) error {
+		if _, err := tx.CreateBucketIfNotExists(boltStoreBucketName); err != nil {
+			return err
+		}
+		return nil
+	})
+	return &bboltStore{db: db}, nil
 }
 
 func (s *bboltStore) Get(key Key) ([]byte, error) {
-	// TODO
-	return nil, nil
+	var res []byte
+	err := s.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket(boltStoreBucketName)
+		if b == nil {
+			return ErrInvalidStore
+		}
+		val := b.Get([]byte(key))
+		if val == nil {
+			return ErrKeyDoesNotExist
+		}
+
+		// Must allocate and copy, memory is owned by bolt, and we should not
+		// assume that its lifetime extends beyond the duration of this tx.
+		res = slices.Clone(val)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return res, nil
 }
 
 func (s *bboltStore) Put(key Key, val []byte) error {
-	// TODO
-	return nil
+	return s.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket(boltStoreBucketName)
+		if b == nil {
+			return ErrInvalidStore
+		}
+		err := b.Put([]byte(key), val)
+		if err != nil {
+			return errors.Join(ErrCouldNotStoreKey, err)
+		}
+		return nil
+	})
 }
 
 func (s *bboltStore) Delete(key Key) error {
-	// TODO
-	return nil
+	return s.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket(boltStoreBucketName)
+		if b == nil {
+			return ErrInvalidStore
+		}
+		err := b.Delete([]byte(key))
+		if err != nil {
+			return errors.Join(ErrCouldNotDeleteKey, err)
+		}
+		return nil
+	})
 }
diff --git a/pkg/secretsstore/err.go b/pkg/secretsstore/err.go
new file mode 100644
index 0000000..2d2a347
--- /dev/null
+++ b/pkg/secretsstore/err.go
@@ -0,0 +1,10 @@
+package secretsstore
+
+import "errors"
+
+var (
+	ErrInvalidStore      = errors.New("the store backing storage is corrupted or invalid")
+	ErrKeyDoesNotExist   = errors.New("the requested key does not exist in the store")
+	ErrCouldNotStoreKey  = errors.New("was not able to store the value in the provided key")
+	ErrCouldNotDeleteKey = errors.New("key was not deleted")
+)
diff --git a/pkg/secretsstore/store.go b/pkg/secretsstore/store.go
index 9d3c981..1aa463e 100644
--- a/pkg/secretsstore/store.go
+++ b/pkg/secretsstore/store.go
@@ -9,7 +9,12 @@ type SecretsStore interface {
 	Delete(key Key) error
 }
 
-func New(path string) SecretsStore {
-	// TODO: Actually instantiate the struct.
-	return &bboltStore{}
+// New returns a SecretsStore that uses the file at path for storage.
+// path is created if it doesn't exist.
+func New(path string) (SecretsStore, error) {
+	bstore, err := newBboltStore(path)
+	if err != nil {
+		return nil, err
+	}
+	return bstore, nil
 }