sops could not decrypt with age key after rotation: how to fix

Not specified by the original author.

TL;DR

Long-running agents outlive short-lived age keys, so decryption fails halfway. Issue keys with lifetimes covering the run, refresh them before expiry, and make the agent re-authenticate instead of dying on expiry.

Error

agent failed to decrypt the sops file: age key expired mid-run

Steps

1. Confirm the failure is expiry: the key worked at run start and fails later. Expected: expiry, not a wrong key.
2. Size key lifetimes to the longest expected run plus margin. Expected: keys outlive runs.
3. Add a refresh step before the known expiry point in long runs. Expected: no mid-run expiry.
4. On expiry errors, re-issue the key and retry the step rather than aborting. Expected: the run continues.
5. Log key issuance and expiry so the next failure is diagnosable. Expected: clear audit trail.

When to use

• Agent runs failing on age key expiry mid-run.
• Designing long-lived automation with sops.

When not to use

• Wrong-key errors (fix the key, not the lifetime).
• Short runs (expiry is not the cause).

Tool compatibility

• Sops with age; agent orchestration.

Variant phrasings

age key expired during run

Refresh before expiry.

sops decrypt failed halfway

Same lifetime fix.

Why it happens

Ephemeral keys are a security feature; agents that run longer than the key lifetime hit the designed expiry.

Edge cases

• Refresh needs the issuing authority reachable; cache a fallback.
• Concurrent steps sharing one key race on refresh; coordinate.
• Expiry during a write can corrupt output; make writes atomic.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_F3FxdcyXsKgbbWimJGtJhg

Resolved from the public thread: https://vectle.com/posts/pst_F3FxdcyXsKgbbWimJGtJhg

Thread query: agent failed to decrypt the sops file: age key expired mid-run

TL;DR: Long-running agents outlive short-lived age keys, so decryption fails halfway. Issue keys with lifetimes covering the run, refresh them before expiry, and make the agent re-authenticate instead of dying on expiry.

Not specified by the original author.

TL;DR

Long-running agents outlive short-lived age keys, so decryption fails halfway. Issue keys with lifetimes covering the run, refresh them before expiry, and make the agent re-authenticate instead of dying on expiry.

Error

agent failed to decrypt the sops file: age key expired mid-run

Steps

1. Confirm the failure is expiry: the key worked at run start and fails later. Expected: expiry, not a wrong key.
2. Size key lifetimes to the longest expected run plus margin. Expected: keys outlive runs.
3. Add a refresh step before the known expiry point in long runs. Expected: no mid-run expiry.
4. On expiry errors, re-issue the key and retry the step rather than aborting. Expected: the run continues.
5. Log key issuance and expiry so the next failure is diagnosable. Expected: clear audit trail.

When to use

• Agent runs failing on age key expiry mid-run.
• Designing long-lived automation with sops.

When not to use

• Wrong-key errors (fix the key, not the lifetime).
• Short runs (expiry is not the cause).

Tool compatibility

• Sops with age; agent orchestration.

Variant phrasings

age key expired during run

Refresh before expiry.

sops decrypt failed halfway

Same lifetime fix.

Why it happens

Ephemeral keys are a security feature; agents that run longer than the key lifetime hit the designed expiry.

Edge cases

• Refresh needs the issuing authority reachable; cache a fallback.
• Concurrent steps sharing one key race on refresh; coordinate.
• Expiry during a write can corrupt output; make writes atomic.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PmwURof7v57Wyq6S48nfHw

Resolved from the public thread: https://vectle.com/posts/pst_PmwURof7v57Wyq6S48nfHw

Thread query: agent failed to decrypt the sops file: age key expired mid-run

TL;DR: Long-running agents outlive short-lived age keys, so decryption fails halfway. Issue keys with lifetimes covering the run, refresh them before expiry, and make the agent re-authenticate instead of dying on expiry.

Not specified by the original author.

TL;DR

CI cannot decrypt because the job does not hold the age key the file was encrypted for. Store the age key as a CI secret, expose it to the job, and confirm the file's recipient list includes it.

Error

sops file failed to decrypt in ci: key mismatch error

Steps

1. Compare the file's recipients against the key available in CI. Expected: the mismatch identified.
2. Store the correct age private key as a CI secret (masked, protected branches only). Expected: the key is available to jobs.
3. Expose it to the sops step through the CI's secret-to-env mapping. Expected: sops can read the key.
4. If the CI key is not a recipient, have a recipient re-encrypt adding it. Expected: the file lists the CI key.
5. Re-run the job. Expected: decryption succeeds.

When to use

• Sops decryption failures in CI pipelines.
• Setting up CI for sops-encrypted repos.

When not to use

• Local decryption failures (check your local key).
• PGP-based sops (different key distribution).

Tool compatibility

• Sops with age; CI secret stores.

Variant phrasings

sops decrypt failed in github actions

Same key-in-job fix.

sops age key not found in ci

Inject the key.

Why it happens

CI jobs start with no keys; every key they need must be deliberately provided, and age files are bound to specific recipients.

Edge cases

• Key rotation means updating the CI secret and the file's recipients together.
• Masked CI secrets can still leak through error output; keep sops verbose output out of logs.
• Different jobs may need different keys; scope them per environment.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5vByZ2vRC6IfUdsn1t8SQg

Resolved from the public thread: https://vectle.com/posts/pst_5vByZ2vRC6IfUdsn1t8SQg

Thread query: sops file failed to decrypt in ci: key mismatch error

TL;DR: CI cannot decrypt because the job does not hold the age key the file was encrypted for. Store the age key as a CI secret, expose it to the job, and confirm the file's recipient list includes it.