diff --git a/tmpl/.sops.yaml b/tmpl/.sops.yaml
index d956a3f9..5839d9a8 100644
--- a/tmpl/.sops.yaml
+++ b/tmpl/.sops.yaml
@@ -2,9 +2,11 @@
 creation_rules:
   - path_regex: provision/.*\.sops\.ya?ml
     unencrypted_regex: "^(kind)$"
-    age: >-
-      ${BOOTSTRAP_AGE_PUBLIC_KEY}
-  - path_regex: cluster/.*\.ya?ml
+    key_groups:
+      - age:
+          - ${BOOTSTRAP_AGE_PUBLIC_KEY}
+  - path_regex: cluster/.*\.sops\.ya?ml
     encrypted_regex: "^(data|stringData)$"
-    age: >-
-      ${BOOTSTRAP_AGE_PUBLIC_KEY}
+    key_groups:
+      - age:
+          - ${BOOTSTRAP_AGE_PUBLIC_KEY}