diff --git a/ci/yamllint.yaml b/ci/yamllint.yaml
index f97d132..68d1bc9 100644
--- a/ci/yamllint.yaml
+++ b/ci/yamllint.yaml
@@ -7,9 +7,13 @@ yaml-files:
   - "*.yaml"
   - "*.yml"
 
-# ansible-vault-encrypted files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML — skip them.
+# Machine-generated encrypted files — skip them:
+#  - ansible-vault files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML.
+#  - SOPS-encrypted secrets (*.sops.yaml) are re-emitted by `sops` with its own indentation
+#    and long ENC[...] / mac lines; they're never hand-edited, so linting them is noise.
 ignore: |
   **/vault.yml
+  **/*.sops.yaml
 
 rules:
   # Kubernetes / Kustomize / Helm manifests routinely exceed 80 cols; allow room
diff --git a/platform/cert-manager/cloudflare-api-token.cert-manager.sops.yaml b/platform/cert-manager/cloudflare-api-token.sops.yaml
similarity index 100%
rename from platform/cert-manager/cloudflare-api-token.cert-manager.sops.yaml
rename to platform/cert-manager/cloudflare-api-token.sops.yaml
diff --git a/platform/cert-manager/kustomization.yaml b/platform/cert-manager/kustomization.yaml
index fd5972c..63b05bc 100644
--- a/platform/cert-manager/kustomization.yaml
+++ b/platform/cert-manager/kustomization.yaml
@@ -7,6 +7,5 @@ resources:
   - helmrelease.yaml
   - clusterissuers.yaml
   # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Operator flow:
-  # copy bootstrap/sops/secret-templates/cloudflare-api-token.cert-manager.yaml.example here as
-  # cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
-  # - cloudflare-api-token.sops.yaml
+  # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Flux decrypts at reconcile.
+  - cloudflare-api-token.sops.yaml
diff --git a/platform/externaldns/cloudflare-api-token.external-dns.sops.yaml b/platform/externaldns/cloudflare-api-token.sops.yaml
similarity index 100%
rename from platform/externaldns/cloudflare-api-token.external-dns.sops.yaml
rename to platform/externaldns/cloudflare-api-token.sops.yaml
diff --git a/platform/externaldns/kustomization.yaml b/platform/externaldns/kustomization.yaml
index 6fec77e..11cc387 100644
--- a/platform/externaldns/kustomization.yaml
+++ b/platform/externaldns/kustomization.yaml
@@ -6,6 +6,5 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   # SOPS-encrypted Cloudflare token (env CF_API_TOKEN) — SAME token as cert-manager, second copy in
-  # the external-dns namespace. Copy bootstrap/sops/secret-templates/cloudflare-api-token.external-dns.yaml.example
-  # here as cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
-  # - cloudflare-api-token.sops.yaml
+  # the external-dns namespace. Flux decrypts at reconcile.
+  - cloudflare-api-token.sops.yaml