- ConfigMap values encrypted with age/SOPS (YubiKey-gated) - Removed secrets.env, secret.yaml, poimen-application.yaml (plaintext) - Worker needs no secrets — uses local LLM via ClusterIP, JWT from activity input - Decrypt: sops-unlock && sops --decrypt k8s/configmap.enc.yaml