diff --git a/shared/sops-decrypt.sh b/shared/sops-decrypt.sh
index 3d2408a..85d8e7d 100644
--- a/shared/sops-decrypt.sh
+++ b/shared/sops-decrypt.sh
@@ -32,7 +32,7 @@ for service_dir in ./*/; do
   install -d -m "$DIR_MODE" -o root -g "$SECRETS_GROUP" -- "$out_dir"
 
   sops -d "$secrets_file" \
-  | yq -r -0 'to_entries[] | "\(.key)\u0000\(.value)\u0000"' \
+  | yq -r -0 'to_entries[] | [.key, .value] | .[]' \
     | while IFS= read -r -d '' key && IFS= read -r -d '' value; do
         [[ "$key" =~ ^[A-Za-z0-9_][-A-Za-z0-9_]*$ ]] || { echo "skip bad key: $key" >&2; continue; }