diff --git a/.gitea/workflows/tf-apply.yml b/.gitea/workflows/tf-apply.yml
index 77785ca..2618827 100644
--- a/.gitea/workflows/tf-apply.yml
+++ b/.gitea/workflows/tf-apply.yml
@@ -36,17 +36,17 @@ jobs:
           make copy-install;
           cd ${{ github.workspace }};
           rm -rf blackbox;
-      - name: Decrypt secrets
-        shell: bash
-        run: |
-          echo ${{ secrets.gpg-key }} | base64 -d | gpg --import;
-          blackbox_decrypt_all_files;
       - uses: hashicorp/setup-terraform@v2
         with:
           terraform_version: 1.5.7
           cli_config_credentials_token: ${{ secrets.tf-api-token }}
       - name: Clone repo
         uses: actions/checkout@v4
+      - name: Decrypt secrets
+        shell: bash
+        run: |
+          echo ${{ secrets.gpg-key }} | base64 -d | gpg --import;
+          blackbox_decrypt_all_files;
       - name: Setup SSH key
         uses: benoitchantre/setup-ssh-authentication-action@1.0.1
         with:
@@ -108,17 +108,17 @@ jobs:
           make copy-install;
           cd ${{ github.workspace }};
           rm -rf blackbox;
-      - name: Decrypt secrets
-        shell: bash
-        run: |
-          echo ${{ secrets.gpg-key }} | base64 -d | gpg --import;
-          blackbox_decrypt_all_files;
       - uses: hashicorp/setup-terraform@v2
         with:
           terraform_version: 1.5.7
           cli_config_credentials_token: ${{ secrets.tf-api-token }}
       - name: Clone repo
         uses: actions/checkout@v4
+      - name: Decrypt secrets
+        shell: bash
+        run: |
+          echo ${{ secrets.gpg-key }} | base64 -d | gpg --import;
+          blackbox_decrypt_all_files;
       - name: Setup SSH key
         uses: benoitchantre/setup-ssh-authentication-action@1.0.1
         with:
diff --git a/.gitea/workflows/tf-plan.yml b/.gitea/workflows/tf-plan.yml
index 34a32fb..d17ab75 100644
--- a/.gitea/workflows/tf-plan.yml
+++ b/.gitea/workflows/tf-plan.yml
@@ -34,17 +34,17 @@ jobs:
           make copy-install;
           cd ${{ github.workspace }};
           rm -rf blackbox;
-      - name: Decrypt secrets
-        shell: bash
-        run: |
-          echo ${{ secrets.gpg-key }} | base64 -d | gpg --import;
-          blackbox_decrypt_all_files;
       - uses: hashicorp/setup-terraform@v2
         with:
           terraform_version: 1.5.7
           cli_config_credentials_token: ${{ secrets.tf-api-token }}
       - name: Clone repo
         uses: actions/checkout@v4
+      - name: Decrypt secrets
+        shell: bash
+        run: |
+          echo ${{ secrets.gpg-key }} | base64 -d | gpg --import;
+          blackbox_decrypt_all_files;
       - name: Setup SSH key
         uses: benoitchantre/setup-ssh-authentication-action@1.0.1
         with: