diff --git a/cluster/apps/auth/realms/bloopysphere/keycloak/ks.yaml b/cluster/apps/auth/realms/bloopysphere/keycloak/ks.yaml
index 36e7c5e926..84612642ae 100644
--- a/cluster/apps/auth/realms/bloopysphere/keycloak/ks.yaml
+++ b/cluster/apps/auth/realms/bloopysphere/keycloak/ks.yaml
@@ -16,6 +16,10 @@ spec:
   wait: true
   dependsOn:
     - name: cluster-iam-keycloak-db-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
   postBuild:
     substitute: {}
     substituteFrom: