Mozilla SOPS combined with Age lets you store encrypted secrets directly in Git — version-controlled and diff-able — without running a secrets management server. This guide covers installation, team setup, CI/CD integration, and key rotation for a lightweight alternative to HashiCorp Vault.