diff --git a/infra/portfolio/base/kustomization.yaml b/infra/portfolio/base/kustomization.yaml
index cc9dc18..24e665a 100644
--- a/infra/portfolio/base/kustomization.yaml
+++ b/infra/portfolio/base/kustomization.yaml
@@ -1,17 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: portfolio
+
 resources:
 - namespace.yaml
-- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
 
+# SOPS-encrypted secrets via ksops generator (ArgoCD repo-server plugin)
+# ksops intercepts encrypted files, decrypts them, returns valid resources
+generatorOptions:
+  disableNameSuffixHash: true
+
+generators:
+  - secret-generator.yaml
+
 # ArgoCD Image Updater configuration - for tag updates
 images:
 - name: forgejo.riotpiao.com/rock/portfolio
   newTag: latest
-
-# Note: SOPS decryption is handled by ArgoCD repo-server plugin,
-# not via kustomization.yaml, to allow Image Updater to parse this file
diff --git a/infra/portfolio/base/secret-generator.yaml b/infra/portfolio/base/secret-generator.yaml
new file mode 100644
index 0000000..693d873
--- /dev/null
+++ b/infra/portfolio/base/secret-generator.yaml
@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: portfolio-secrets-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - configmap.enc.yaml