diff --git a/Makefile b/Makefile
index 6b10301..8b0b9c8 100644
--- a/Makefile
+++ b/Makefile
@@ -11,14 +11,15 @@ KEYS := \
 	88823A75ECAA786B0FF38B148E401478A3FBEF72 \
 	3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
 
-ifeq ("$(wildcard $(CACHE_DIR)/secrets/$(ENVIRONMENT).env)","")
-	gpg --decrypt \
-		secrets/$(ENVIRONMENT).env.gpg \
-	> $(CACHE_DIR)/secrets/$(ENVIRONMENT).env
+SKIP_SECRETS=
+ifeq ("$(wildcard $(CACHE_DIR)/secrets/$(ENVIRONMENT).env)$(SKIP_SECRETS)","")
+	noop=$(shell \
+		 $(MAKE) SKIP_SECRETS=1 $(CACHE_DIR)/secrets/$(ENVIRONMENT).env \
+	)
 endif
 
 include $(CACHE_DIR)/secrets/$(ENVIRONMENT).env
-export $(shell sed 's/=.*//' $(CACHE_DIR)/secrets/$(ENVIRONMENT).env)
+export $(shell sed 's/=.*//' $(CACHE_DIR)/secrets/$(ENVIRONMENT).env 2>/dev/null)
 
 .DEFAULT_GOAL :=
 .PHONY: default
@@ -67,9 +68,10 @@ infra/backend/$(ENVIRONMENT).tfstate: \
 		-var region=$(REGION) \
 		-state ../../$@
 
-config/$(ENVIRONMENT).tfbackend: | \
-	infra/backend/$(ENVIRONMENT).tfstate \
+config/$(ENVIRONMENT).tfbackend: \
 	$(OUT_DIR)/terraform
+	# File is not committed and this has no shared state
+	$(MAKE) infra/backend/$(ENVIRONMENT).tfstate
 	env -C infra/backend $(TERRAFORM) \
 		output -state ../../$< \
 		> $@
@@ -87,7 +89,8 @@ $(CACHE_DIR)/secrets:
 	mkdir -p $@
 
 $(CACHE_DIR)/secrets/%.env: secrets/%.env.gpg $(CACHE_DIR)/secrets
-	gpg --decrypt $< > $@
+	@echo "Decrypting $@"
+	gpg --decrypt $< 2>/dev/null > $@
 
 $(FETCH_DIR)/terraform:
 	$(call git_clone,$@,$(TERRAFORM_REPO),$(TERRAFORM_REF))