diff --git a/.sops.yaml b/.sops.yaml
index ce9c6c1..d5ac91b 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,3 +1,7 @@
 creation_rules:
   - path_regex: infrastructure-secrets\.yaml$
-    age: age198ea80z7gan2ruetn288ln6rl2qh7xtsqqpwrjtyn8maya3364fsvpdd63
+    # Переходный период разделения ключей по окружениям: старый общий ключ
+    # (все три окружения) остаётся вторым получателем, пока CI-переменная
+    # SOPS_AGE_KEY не переключена на новый contour-only ключ в каждой Gitea
+    # контура. После переключения старый recipient убрать отсюда.
+    age: age1ztyyem7qy3fn7vjprnadhsv2txds8a63pr76uut264qwnwxv8v9qwpkagt,age198ea80z7gan2ruetn288ln6rl2qh7xtsqqpwrjtyn8maya3364fsvpdd63
diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index 01cb01b..2d73dae 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -2499,17 +2499,31 @@ environments:
               lifecycle:
                 ignore_changes: ENC[AES256_GCM,data:6zuUUpw=,iv:H+85XC0hgx9FQxARe2YX3qxvI8sOWB6PQF/9IkXLmHw=,tag:5472qN+GMNNZfC8ziSAEDQ==,type:bool]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
+        - recipient: age1ztyyem7qy3fn7vjprnadhsv2txds8a63pr76uut264qwnwxv8v9qwpkagt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OEN3ME1FK2JnQzYycUlM
+            blp1SXZGUXhnNEZwdWEvNjh4Zk5Jcmdjc0RjCm5Nb09iYUV5MjRqTjRBLzJ6MnFP
+            dFBkdldlR2wvb1pOOEdhVzBncU0zY3MKLS0tIGgvU1hNck8vbDB0VTNIWk5QaVhI
+            Y0tBVzZSSGFBWlFlZXU2Nm5kS3JWa0EKWWn+S/EIUljZydTXkZvzySMRA1iIjr1n
+            qtpb/0LT4Bh4FFeOqMmDFxiSbKRdXk2j4qvkO9dapyjJ3W7sci5DUA==
+            -----END AGE ENCRYPTED FILE-----
         - recipient: age198ea80z7gan2ruetn288ln6rl2qh7xtsqqpwrjtyn8maya3364fsvpdd63
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjanQ1cjBOWDljUVFJRklS
-            K0tpUFpZbmZPR3BWTDRKN0o2NlpFNVZiSUNzCkZIZUlld1liZmYrUURvUGxxUkE1
-            dmRUYzh3Si9xNDN2eTdoNGcvZ3M4QU0KLS0tIGdrWFpjRkI5M3U4VjR3dk42ek84
-            SW9TWmFXd2Y1NlpUYUhFZ2U1dVFhNVEKbDvMmsURmY4Z2EMAb/gtARP1X3mNjGvn
-            TDttyAjIujotzAnPlAs8oAm1CEkFOy9YidRjzr/vB4gwOUKFXyvNlQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvOUJyM01BN2pmREROdFIw
+            SExjZ0lINlJLcFRLSlJ1UEhXYmtib2daRjNnCnIwM0w4TzdUcXU4eWJxbnJZQ1Zy
+            eFNmbno2S2U4RGpiQUNiamVmT1JwZkkKLS0tIGRIV05mbnpMbklrOW9ud0pxc1R1
+            YXVzcEVPQ3RJN0RUdU9jNjRnMVovRmMKwk/F7v0NVqVQKKEp53B2Le5Q+WcJRpmv
+            A5qicqqVVMcTFV6AmyKf6MPkqzrKXaa36C/nd2JPnjMVzjJZp8/3AA==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-08-04T07:29:18Z"
     mac: ENC[AES256_GCM,data:z8IC6qP5XJdRMAWv1nFgK4pjeeIz2SF+DoiymUyPSbKF2sb9I/HNdoSr52EubnRoIZb8KfqTRaK63flMmAJ9Lm0fZGBcWeEGT8IZ7u3o6q6UBZgGm08Iqh99cdFXgttTJaRw/Wl4K12micj809noRpV64PXKk0SK4ahI0e+DT7s=,iv:Fzr2Ytt8JzGnr4D1YK2/Ee93cpERe5lo5xUq2pfOHFs=,tag:lbdOh2yIX3FMMLCmswWD8Q==,type:str]
+    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.12.2