diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml
index 3f83daa..eede994 100644
--- a/.gitea/workflows/terraform.yml
+++ b/.gitea/workflows/terraform.yml
@@ -51,7 +51,6 @@ jobs:
       S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
       VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
-      SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
       KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
       KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
       KUBECONFIG: /workspace/.kube/config
@@ -84,10 +83,20 @@ jobs:
           else
             echo "No KUBECONFIG_B64 — in-cluster runner: kubernetes/vault providers use the pod ServiceAccount kubeconfig or in-cluster config."
           fi
+      - name: Decrypt secret values
+        # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
+        # (checkout, kubeconfig, terragrunt run) never sees it.
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+        run: |
+          if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
+          sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
+          echo "INFRA_SECRET_VALUES_FILE=/tmp/infra-secret-values.yaml" >> "$GITHUB_ENV"
       - name: Run validate for all stacks
         run: |
           . ./scripts/load_admin_creds.sh
           ./scripts/run_all_stacks.sh validate
+          rm -f /tmp/infra-secret-values.yaml
 
   plan:
     needs: [validate]
@@ -101,7 +110,6 @@ jobs:
       S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
       VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
-      SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
       KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
       KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
       KUBECONFIG: /workspace/.kube/config
@@ -132,10 +140,20 @@ jobs:
             echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
             chmod 600 /workspace/.kube/config
           fi
+      - name: Decrypt secret values
+        # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
+        # (checkout, kubeconfig, terragrunt run) never sees it.
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+        run: |
+          if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
+          sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
+          echo "INFRA_SECRET_VALUES_FILE=/tmp/infra-secret-values.yaml" >> "$GITHUB_ENV"
       - name: Run plan for all stacks
         run: |
           . ./scripts/load_admin_creds.sh
           ./scripts/run_all_stacks.sh plan
+          rm -f /tmp/infra-secret-values.yaml
 
   apply:
     needs: [plan]
@@ -150,7 +168,6 @@ jobs:
       S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
       VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
-      SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
       KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
       KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
       KUBECONFIG: /workspace/.kube/config
@@ -181,7 +198,17 @@ jobs:
             echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
             chmod 600 /workspace/.kube/config
           fi
+      - name: Decrypt secret values
+        # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
+        # (checkout, kubeconfig, terragrunt run) never sees it.
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+        run: |
+          if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
+          sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
+          echo "INFRA_SECRET_VALUES_FILE=/tmp/infra-secret-values.yaml" >> "$GITHUB_ENV"
       - name: Run apply for all stacks
         run: |
           . ./scripts/load_admin_creds.sh
           ./scripts/run_all_stacks.sh apply
+          rm -f /tmp/infra-secret-values.yaml
diff --git a/live/vault-secrets/terragrunt.hcl b/live/vault-secrets/terragrunt.hcl
index aa2459c..c74558a 100644
--- a/live/vault-secrets/terragrunt.hcl
+++ b/live/vault-secrets/terragrunt.hcl
@@ -7,7 +7,12 @@ locals {
   infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
   secrets_file = "${local.repo_root}/infrastructure-secrets.yaml"
 
-  secrets_config = try(yamldecode(sops_decrypt_file(local.secrets_file)), {})
+  # В CI файл расшифровывается заранее одним шагом, и путь передаётся через
+  # INFRA_SECRET_VALUES_FILE (SOPS_AGE_KEY нужен только этому шагу, не всей
+  # джобе). Локально - fallback на прямую расшифровку через sops_decrypt_file.
+  secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
+  secrets_config_raw     = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file(local.secrets_file), "")
+  secrets_config         = try(yamldecode(local.secrets_config_raw), {})
 
   env_override   = trimspace(get_env("INFRA_ENV", ""))
   env_from_file  = try(trimspace(local.infra_config.current_environment), "")