diff --git a/.a8c-secrets/Jetpack-Secrets.swift.age b/.a8c-secrets/Jetpack-Secrets.swift.age
new file mode 100644
index 000000000000..9651032edc07
Binary files /dev/null and b/.a8c-secrets/Jetpack-Secrets.swift.age differ
diff --git a/.a8c-secrets/Reader-Secrets.swift.age b/.a8c-secrets/Reader-Secrets.swift.age
new file mode 100644
index 000000000000..d26e60b68340
Binary files /dev/null and b/.a8c-secrets/Reader-Secrets.swift.age differ
diff --git a/.a8c-secrets/WordPress-Secrets.swift.age b/.a8c-secrets/WordPress-Secrets.swift.age
new file mode 100644
index 000000000000..e65b3b22e854
Binary files /dev/null and b/.a8c-secrets/WordPress-Secrets.swift.age differ
diff --git a/.a8c-secrets/keys.pub b/.a8c-secrets/keys.pub
new file mode 100644
index 000000000000..af1dfa3e9cfc
--- /dev/null
+++ b/.a8c-secrets/keys.pub
@@ -0,0 +1,4 @@
+# dev
+age1srcq3hl92ym9jk3ezj5prwhche3w8szc0cssy8t7afrkjmtkxu2qkjsdfn
+# ci
+age1a7xcr6qzwnzgcxq95sq33p58xdzsmful8w7mp2zktvuy5434yuss9rmv8f
diff --git a/.a8c-secrets/repo-id b/.a8c-secrets/repo-id
new file mode 100644
index 000000000000..b60ad318d574
--- /dev/null
+++ b/.a8c-secrets/repo-id
@@ -0,0 +1 @@
+wordpress-ios@github.com@wordpress-mobile
diff --git a/.buildkite/commands/build-and-upload-testflight.sh b/.buildkite/commands/build-and-upload-testflight.sh
index d8d6ee04a81b..7a65810c4917 100755
--- a/.buildkite/commands/build-and-upload-testflight.sh
+++ b/.buildkite/commands/build-and-upload-testflight.sh
@@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :testflight: Building and uploading ${APP} to TestFlight"
 bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"
diff --git a/.buildkite/commands/build-for-testing.sh b/.buildkite/commands/build-for-testing.sh
index 80fd7fae1e68..4350e855fed2 100755
--- a/.buildkite/commands/build-for-testing.sh
+++ b/.buildkite/commands/build-for-testing.sh
@@ -16,8 +16,7 @@ fi
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane "build_${APP}_for_testing"
diff --git a/.buildkite/commands/complete-code-freeze.sh b/.buildkite/commands/complete-code-freeze.sh
index 9297d9e4d298..bde99028ed0c 100755
--- a/.buildkite/commands/complete-code-freeze.sh
+++ b/.buildkite/commands/complete-code-freeze.sh
@@ -14,8 +14,7 @@ source use-bot-for-git
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Complete code freeze'
 bundle exec fastlane complete_code_freeze skip_confirm:true
diff --git a/.buildkite/commands/finalize-hotfix.sh b/.buildkite/commands/finalize-hotfix.sh
index cb3be53d1d66..d42699302d2d 100755
--- a/.buildkite/commands/finalize-hotfix.sh
+++ b/.buildkite/commands/finalize-hotfix.sh
@@ -15,8 +15,7 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Finalize hotfix'
 bundle exec fastlane finalize_hotfix_release skip_confirm:true
diff --git a/.buildkite/commands/finalize-release.sh b/.buildkite/commands/finalize-release.sh
index bbba37e01b8d..e553e49b3e53 100755
--- a/.buildkite/commands/finalize-release.sh
+++ b/.buildkite/commands/finalize-release.sh
@@ -15,8 +15,7 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Finalize release'
 bundle exec fastlane finalize_release skip_confirm:true
diff --git a/.buildkite/commands/gather-testflight-candidates.sh b/.buildkite/commands/gather-testflight-candidates.sh
index c7c2052b62c6..9100c091e958 100755
--- a/.buildkite/commands/gather-testflight-candidates.sh
+++ b/.buildkite/commands/gather-testflight-candidates.sh
@@ -6,8 +6,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :testflight: Gathering candidates and opening the block step"
 bundle exec fastlane gather_testflight_candidates
diff --git a/.buildkite/commands/install-secrets.sh b/.buildkite/commands/install-secrets.sh
new file mode 100755
index 000000000000..e5192c78f8ff
--- /dev/null
+++ b/.buildkite/commands/install-secrets.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "--- :closed_lock_with_key: Installing Secrets"
+curl -fsSL https://raw.githubusercontent.com/Automattic/a8c-secrets/main/install.sh | bash
+# The installer puts the binary in ~/.local/bin, which isn't on the agent's PATH.
+export PATH="$HOME/.local/bin:$PATH"
+bundle exec fastlane configure_secrets
diff --git a/.buildkite/commands/promote-build-to-public.sh b/.buildkite/commands/promote-build-to-public.sh
index d7d510d10196..935e316a2df8 100755
--- a/.buildkite/commands/promote-build-to-public.sh
+++ b/.buildkite/commands/promote-build-to-public.sh
@@ -14,8 +14,7 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :rocket: Promoting ${BUILD_CODE} to public beta"
 bundle exec fastlane promote_build build_code:"${BUILD_CODE}"
diff --git a/.buildkite/commands/promote-nightly.sh b/.buildkite/commands/promote-nightly.sh
index 76e15e7aa168..e313e561f2e1 100755
--- a/.buildkite/commands/promote-nightly.sh
+++ b/.buildkite/commands/promote-nightly.sh
@@ -5,8 +5,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :new_moon: Promoting last build of the day to nightly beta"
 # The lane refuses to run anywhere but trunk.
diff --git a/.buildkite/commands/prototype-build-jetpack.sh b/.buildkite/commands/prototype-build-jetpack.sh
index 8e91a0bdbfe8..621edef8bd75 100644
--- a/.buildkite/commands/prototype-build-jetpack.sh
+++ b/.buildkite/commands/prototype-build-jetpack.sh
@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_prototype_build
diff --git a/.buildkite/commands/prototype-build-wordpress.sh b/.buildkite/commands/prototype-build-wordpress.sh
index 1798ddb780b8..9b649f5b636a 100644
--- a/.buildkite/commands/prototype-build-wordpress.sh
+++ b/.buildkite/commands/prototype-build-wordpress.sh
@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_wordpress_prototype_build
diff --git a/.buildkite/commands/release-build-jetpack.sh b/.buildkite/commands/release-build-jetpack.sh
index 0c8b3ad9f3e0..7de02454d910 100755
--- a/.buildkite/commands/release-build-jetpack.sh
+++ b/.buildkite/commands/release-build-jetpack.sh
@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_for_app_store
diff --git a/.buildkite/commands/release-build-wordpress.sh b/.buildkite/commands/release-build-wordpress.sh
index 86326de30ba7..d8e92522c4d9 100755
--- a/.buildkite/commands/release-build-wordpress.sh
+++ b/.buildkite/commands/release-build-wordpress.sh
@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_app_store_connect \
diff --git a/.buildkite/release-pipelines/code-freeze.yml b/.buildkite/release-pipelines/code-freeze.yml
index e03a83cfbe41..aebbd91bf1f5 100644
--- a/.buildkite/release-pipelines/code-freeze.yml
+++ b/.buildkite/release-pipelines/code-freeze.yml
@@ -18,8 +18,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Run code freeze'
       bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true
diff --git a/.buildkite/release-pipelines/new-beta-release.yml b/.buildkite/release-pipelines/new-beta-release.yml
index 4835caaf293e..e0040a418816 100644
--- a/.buildkite/release-pipelines/new-beta-release.yml
+++ b/.buildkite/release-pipelines/new-beta-release.yml
@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Deploy new beta'
       bundle exec fastlane new_beta_release skip_confirm:true
diff --git a/.buildkite/release-pipelines/new-hotfix.yml b/.buildkite/release-pipelines/new-hotfix.yml
index ec8deef72852..b9b499a5fed0 100644
--- a/.buildkite/release-pipelines/new-hotfix.yml
+++ b/.buildkite/release-pipelines/new-hotfix.yml
@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Start new hotfix'
       bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION"
diff --git a/.buildkite/release-pipelines/publish-release.yml b/.buildkite/release-pipelines/publish-release.yml
index 024c3f616f90..abb9518ce335 100644
--- a/.buildkite/release-pipelines/publish-release.yml
+++ b/.buildkite/release-pipelines/publish-release.yml
@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :package: Publish Release'
       bundle exec fastlane publish_release skip_confirm:true
diff --git a/.buildkite/release-pipelines/update-app-store-strings.yml b/.buildkite/release-pipelines/update-app-store-strings.yml
index 83dc1a1bd6b5..dbab84f50e0c 100644
--- a/.buildkite/release-pipelines/update-app-store-strings.yml
+++ b/.buildkite/release-pipelines/update-app-store-strings.yml
@@ -18,10 +18,9 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
-      echo '--- :shipit: Update relaese notes and other App Store metadata'
+      echo '--- :shipit: Update release notes and other App Store metadata'
       bundle exec fastlane update_appstore_strings skip_confirm:true
     retry:
       manual:
diff --git a/.configure b/.configure
deleted file mode 100644
index 4da74081ca7c..000000000000
--- a/.configure
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "project_name": "WordPress-iOS",
-  "branch": "trunk",
-  "pinned_hash": "6baf4e086398ddf8141d7132e557703a715fafd2",
-  "files_to_copy": [
-    {
-      "file": "iOS/WPiOS/Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/WPiOS/Secrets-Internal.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/WPiOS/Secrets-Alpha.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/JPiOS/Jetpack-Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/Reader/Reader-Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/Reader-Secrets.swift",
-      "encrypt": true
-    }
-  ],
-  "file_dependencies": []
-}
diff --git a/.configure-files/Jetpack-Secrets.swift.enc b/.configure-files/Jetpack-Secrets.swift.enc
deleted file mode 100644
index ea3cc37302b2..000000000000
Binary files a/.configure-files/Jetpack-Secrets.swift.enc and /dev/null differ
diff --git a/.configure-files/Reader-Secrets.swift.enc b/.configure-files/Reader-Secrets.swift.enc
deleted file mode 100644
index ccf158a9cbf1..000000000000
Binary files a/.configure-files/Reader-Secrets.swift.enc and /dev/null differ
diff --git a/.configure-files/Secrets-Alpha.swift.enc b/.configure-files/Secrets-Alpha.swift.enc
deleted file mode 100644
index 6d064130c099..000000000000
Binary files a/.configure-files/Secrets-Alpha.swift.enc and /dev/null differ
diff --git a/.configure-files/Secrets-Internal.swift.enc b/.configure-files/Secrets-Internal.swift.enc
deleted file mode 100644
index 034b369c157c..000000000000
Binary files a/.configure-files/Secrets-Internal.swift.enc and /dev/null differ
diff --git a/.configure-files/Secrets.swift.enc b/.configure-files/Secrets.swift.enc
deleted file mode 100644
index 500132fd96da..000000000000
Binary files a/.configure-files/Secrets.swift.enc and /dev/null differ
diff --git a/.gitattributes b/.gitattributes
index 648ab329c02f..3b002f08fa65 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,4 @@
 RELEASE-NOTES.txt merge=union
 *.strings diff=localizablestrings
 
-.configure-files/*.enc binary
+.a8c-secrets/*.age binary
diff --git a/.gitignore b/.gitignore
index 5a9c41b95f6e..8d4ddae3e134 100644
--- a/.gitignore
+++ b/.gitignore
@@ -90,10 +90,12 @@ Artifacts
 WordPress/Resources/AppImages.xcassets/AppIcon-Internal.appiconset
 WordPress/Resources/Icons-Internal
 
-# All encrypted secrets should be stored under .configure-files
-# Everything without a .enc extension is ignored
-.configure-files/*
-!.configure-files/*.enc
+# a8c-secrets decrypts into ~/.a8c-secrets/<repo-id>/, outside the checkout.
+# In-repo, track only the repo id, the public keys, and the encrypted *.age blobs.
+.a8c-secrets/*
+!.a8c-secrets/repo-id
+!.a8c-secrets/keys.pub
+!.a8c-secrets/*.age
 
 # A file external contributors can have locally to provide their own credentials.
 # This file is created during the `rake init:oss` task, based on the Secrets-example.swift file.
diff --git a/CODEOWNERS b/CODEOWNERS
index c29db1d94519..220249b7e6e5 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -24,4 +24,4 @@ Dangerfile*           @wordpress-mobile/apps-infra-tooling
 .xcode-version        @wordpress-mobile/apps-infra-tooling
 
 # Secrets
-.configure-files/     @wordpress-mobile/apps-infra-tooling
+.a8c-secrets/         @wordpress-mobile/apps-infra-tooling
diff --git a/Rakefile b/Rakefile
index fd7736531eda..ebd8e8e857b7 100644
--- a/Rakefile
+++ b/Rakefile
@@ -77,20 +77,11 @@ namespace :dependencies do
 
   namespace :credentials do
     task :apply do
-      next unless Dir.exist?(File.join(Dir.home, '.mobile-secrets/.git')) || ENV.key?('CONFIGURE_ENCRYPTION_KEY')
-
-      # The string is indented all the way to the left to avoid padding when printed in the terminal
-      command = %(
-FASTLANE_SKIP_UPDATE_CHECK=1 \
-FASTLANE_HIDE_CHANGELOG=1 \
-FASTLANE_HIDE_PLUGINS_TABLE=1 \
-FASTLANE_ENV_PRINTER=1 \
-FASTLANE_SKIP_ACTION_SUMMARY=1 \
-FASTLANE_HIDE_TIMESTAMP=1 \
-bundle exec fastlane run configure_apply force:true
-      )
-
-      sh(command)
+      # Skip when a8c-secrets isn't installed so open-source builds — which fall back
+      # to the templated credentials — don't fail here.
+      next unless system('command -v a8c-secrets > /dev/null 2>&1')
+
+      sh('FASTLANE_SKIP_UPDATE_CHECK=1 bundle exec fastlane configure_secrets')
     end
   end
 
diff --git a/Scripts/BuildPhases/GenerateCredentials.sh b/Scripts/BuildPhases/GenerateCredentials.sh
index ebef9d0644cc..9fbdcc68386f 100755
--- a/Scripts/BuildPhases/GenerateCredentials.sh
+++ b/Scripts/BuildPhases/GenerateCredentials.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -euo pipefail
 
 # The Secrets File Sources
-SECRETS_ROOT="${HOME}/.configure/wordpress-ios/secrets"
+SECRETS_ROOT="${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile"
 
 # To help the Xcode build system optimize the build, we want to ensure each of
 # the secrets we want to copy is defined as an input file for the run script
@@ -105,7 +105,7 @@ fi
 # resort, unless building for Release.
 
 COULD_NOT_FIND_SECRET_MSG="Could not find secrets file at ${SECRETS_DESTINATION_FILE}. This is likely due to the source secrets being missing from ${SECRETS_ROOT}"
-INTERNAL_CONTRIBUTOR_MSG="If you are an internal contributor, run \`bundle exec fastlane run configure_apply\` to update your secrets and try again"
+INTERNAL_CONTRIBUTOR_MSG="If you are an internal contributor, run \`bundle exec fastlane configure_secrets\` to update your secrets and try again"
 EXTERNAL_CONTRIBUTOR_MSG="If you are an external contributor, run \`bundle exec rake init:oss\` to set up and use your own credentials"
 
 case $CONFIGURATION in
diff --git a/Scripts/BuildPhases/GenerateCredentials.xcfilelist b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
index c52def6be2d1..ac97ea792efe 100644
--- a/Scripts/BuildPhases/GenerateCredentials.xcfilelist
+++ b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
@@ -1,10 +1,8 @@
 # Lists of input files for the script that populates the app's secrets with the
 # correct values for the current scheme and build configuration.
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift
-${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift
+${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/WordPress-Secrets.swift
+${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/Jetpack-Secrets.swift
+${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/Reader-Secrets.swift
 
 # Local Secrets file that external contributors can use to specify their own
 # ClientID and Secrets. This file is created by the Rakefile when external
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 823955b10a10..6aafef0f4353 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -195,6 +195,11 @@ before_all do |lane|
   # Fixes weird Keychain bugs
   setup_ci
 
+  # Decrypt secrets so every lane can rely on them. Cheap and redundant on dev
+  # machines; in CI the binary isn't on this process's PATH (install-secrets.sh
+  # already decrypted them), so configure_secrets no-ops via its is_ci branch.
+  configure_secrets unless lane == :configure_secrets
+
   # Check that the env files exist
   unless is_ci || File.file?(USER_ENV_FILE_PATH)
     example_path = 'fastlane/env/user.env-example '
@@ -202,6 +207,20 @@ before_all do |lane|
   end
 end
 
+# Decrypt the app secrets using `a8c-secrets`.
+lane :configure_secrets do
+  unless FastlaneCore::CommandExecutor.which('a8c-secrets')
+    if is_ci
+      UI.important('`a8c-secrets` was not found on the PATH, but given CI execution was detected, we assume secrets have already been decrypted. See https://linear.app/a8c/issue/AINFRA-2681.')
+      next
+    else
+      UI.user_error!('`a8c-secrets` was not found on your PATH. See https://github.com/Automattic/a8c-secrets for installation and usage instructions.')
+    end
+  end
+
+  sh('a8c-secrets', 'decrypt')
+end
+
 def compute_release_branch_name(options:, version: release_version_current)
   branch_option = :branch
   branch_name = options[branch_option]