diff --git a/.gitignore b/.gitignore
index 44b3974..823d783 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ result-*
 
 # needed for treefmt
 !.github
+!.sops.yaml
diff --git a/.sops.yaml b/.sops.yaml
index bfde39c..d913d97 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -13,70 +13,70 @@ keys:
 creation_rules:
   - path_regex: ^secrets.yaml$
     key_groups:
-    - age:
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: terraform/secrets.yaml$
     key_groups:
-    - age:
-      - *github_actions
-      - *hercules_tf
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *github_actions
+          - *hercules_tf
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: build01/[^/]+\.yaml$
     key_groups:
-    - age:
-      - *build01
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *build01
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: build02/[^/]+\.yaml$
     key_groups:
-    - age:
-      - *build02
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *build02
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: build03/[^/]+\.yaml$
     key_groups:
-    - age:
-      - *build03
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *build03
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: build04/[^/]+\.yaml$
     key_groups:
-    - age:
-      - *build04
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *build04
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: roles/hercules-ci/.+\.yaml$
     key_groups:
-    - age:
-      - *build02
-      - *build03
-      - *build04
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *build02
+          - *build03
+          - *build04
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq
   - path_regex: roles/.+\.yaml$
     key_groups:
-    - age:
-      - *build01
-      - *build02
-      - *build03
-      - *build04
-      - *mic92
-      - *ryantm
-      - *zimbatm
-      - *zowoq
+      - age:
+          - *build01
+          - *build02
+          - *build03
+          - *build04
+          - *mic92
+          - *ryantm
+          - *zimbatm
+          - *zowoq