diff --git a/live/secrets/terragrunt.hcl b/live/secrets/terragrunt.hcl
index d86ab38..eea02d7 100644
--- a/live/secrets/terragrunt.hcl
+++ b/live/secrets/terragrunt.hcl
@@ -35,6 +35,17 @@ locals {
 
   secret_values_env = local.secret_values_config.environments[local.env_name]
 
+  # A typo in the "secrets" key itself (e.g. "secretz") opens the same hole
+  # as the per-entry typos below: try() on the secrets line below can't tell
+  # "key absent because 0 secrets declared" from "key renamed by a typo" -
+  # both yield []. Explicitly validate the env's allowed top-level keys.
+  allowed_secret_env_keys = toset(["secrets", "vault"])
+  secret_env_key_typos = [
+    for k in keys(local.secret_values_env) : "env '${local.env_name}': unknown top-level key '${k}'"
+    if !contains(local.allowed_secret_env_keys, k)
+  ]
+  _fail_on_secret_env_key_typos = length(local.secret_env_key_typos) > 0 ? file("Unknown/misspelled top-level key(s) in infrastructure-secrets.yaml: ${join(" | ", local.secret_env_key_typos)}") : ""
+
   # secrets key itself may legitimately be absent for an environment with 0
   # secrets declared - that one stays a real default, not an error.
   secrets = try(local.secret_values_env.secrets, [])
diff --git a/live/vault-secrets/terragrunt.hcl b/live/vault-secrets/terragrunt.hcl
index 7c7e315..6174b06 100644
--- a/live/vault-secrets/terragrunt.hcl
+++ b/live/vault-secrets/terragrunt.hcl
@@ -34,7 +34,19 @@ locals {
   # ошибки terraform "no such file".
   _fail_on_missing_secret_env = !contains(keys(local.secrets_config.environments), local.env_name) ? file("INFRA_ENV '${local.env_name}' not found in infrastructure-secrets.yaml environments: [${join(", ", keys(local.secrets_config.environments))}]") : ""
 
-  env_config    = local.secrets_config.environments[local.env_name]
+  env_config = local.secrets_config.environments[local.env_name]
+
+  # Опечатка в самом ключе "vault" (например "vaultt") даёт ту же дыру, что
+  # и провалившийся decrypt: try() ниже не отличит "vault осознанно не задан"
+  # от "ключ переименован опечаткой" - в обоих случаях vault_config = {} и
+  # план "нечего менять в vault" выглядит легитимно.
+  allowed_env_config_keys = toset(["secrets", "vault"])
+  env_config_key_typos = [
+    for k in keys(local.env_config) : "env '${local.env_name}': unknown top-level key '${k}'"
+    if !contains(local.allowed_env_config_keys, k)
+  ]
+  _fail_on_env_config_key_typos = length(local.env_config_key_typos) > 0 ? file("Unknown/misspelled top-level key(s) in infrastructure-secrets.yaml: ${join(" | ", local.env_config_key_typos)}") : ""
+
   vault_config  = try(local.env_config.vault, {})
   vault_enabled = try(local.vault_config.enabled, false)
 }