The SOPS-encrypted secret existed locally but was untracked and not in the kustomization, so Flux never applied it and both wiki pods stayed in CreateContainerConfigError (secret not found). Add it to resources and commit. Values not read; age recipient matches .sops.yaml so Flux can decrypt.