diff --git a/Makefile b/Makefile
index fac41ba..e8c77ad 100644
--- a/Makefile
+++ b/Makefile
@@ -6,8 +6,9 @@ MAIN_TF := $(wildcard infra/main/*.tf)
 ENVIRONMENT := production
 REGION := sfo3
 ROOT_DIR := $(shell pwd)
-TERRAFORM := $(ROOT_DIR)/out/terraform
-SOPS := $(ROOT_DIR)/out/sops
+# TODO: automatically determine
+TERRAFORM := $(ROOT_DIR)/out/terraform.linux-x86_64
+SOPS := $(ROOT_DIR)/out/sops.linux-x86_64
 KEYS := \
 	6B61ECD76088748C70590D55E90A401336C8AAA9 \
 	88823A75ECAA786B0FF38B148E401478A3FBEF72 \
@@ -151,6 +152,7 @@ endef
 # than the encrypted secrets, we want to reencrypt encrypted secrets.
 define maybe_decrypt_secret
 	test -f $(1) -a ! -f $(2) && \
+		mkdir -p `dirname $(2)` && \
 		$(SOPS) --decrypt $(1) > $(2) && \
 		touch -d 1970-01-01 $(2) || \
 		true
diff --git a/config/make.env b/config/make.env
index 0c1806b..6a5d6c9 100644
--- a/config/make.env
+++ b/config/make.env
@@ -18,7 +18,7 @@ KUBERNETES_REPO=https://github.com/kubernetes/kubernetes.git
 GO_URL=https://go.dev/dl/go1.21.0.src.tar.gz
 GO_HASH=818d46ede85682dd551ad378ef37a4d247006f12ec59b5b755601d2ce114369a
 SOPS_REPO=https://github.com/getsops/sops
-SOPS_REF=7b3a032adee818183189c89fcbbae212fbd50318
+SOPS_REF=b6d3c9700d88e0c9348f3ec7cd2f10ce4a4b3ee1
 BUSYBOX_URL=https://busybox.net/downloads/busybox-1.36.1.tar.bz2
 BUSYBOX_HASH=b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314
 TOFU_REPO=https://github.com/opentofu/opentofu
diff --git a/fetch/sops.tar.gz b/fetch/sops.tar.gz
index a96b98e..8cdbcc8 100644
--- a/fetch/sops.tar.gz
+++ b/fetch/sops.tar.gz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:5f994a48d0c6b927076decc4f5e1432560da6cfdbfe27595c5654d304d3b07ad
-size 149520574
+oid sha256:7da5d5025442ddeac78ab87be626fad3b3348d4f80d6da9cca487b1893690a09
+size 149144687
diff --git a/out/sops.linux-x86_64 b/out/sops.linux-x86_64
index 0c23e2d..b7367df 100755
--- a/out/sops.linux-x86_64
+++ b/out/sops.linux-x86_64
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:5453dd5914701991f679fc118d2dba92f15a3c5e2068ee4fbd0fb80ad79ff3c1
-size 33695694
+oid sha256:f809310fd11f09a0708e848c6e721e97d4f5956646940c48e31e1968d7467103
+size 32378737