diff --git a/.buildkite/commands/install-secrets.sh b/.buildkite/commands/install-secrets.sh
new file mode 100755
index 000000000..0cd2f4290
--- /dev/null
+++ b/.buildkite/commands/install-secrets.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "--- :closed_lock_with_key: Installing Secrets"
+
+a8c_secrets_bin_dir="$HOME/.local/bin"
+install_a8c-secrets_binary --install-dir "$a8c_secrets_bin_dir"
+export PATH="$a8c_secrets_bin_dir:$PATH"
+
+a8c-secrets decrypt --non-interactive
diff --git a/.buildkite/commands/prototype-build.sh b/.buildkite/commands/prototype-build.sh
index dceeea803..bc0e04deb 100755
--- a/.buildkite/commands/prototype-build.sh
+++ b/.buildkite/commands/prototype-build.sh
@@ -3,8 +3,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_prototype_build
diff --git a/AGENTS.md b/AGENTS.md
index 122953933..a91429245 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -97,4 +97,4 @@ SDK version is derived from `git describe --tags`. Non-tag builds append `-SNAPS
 - **Screenshot test baselines**: Must pass `-Pscreenshot` flag for Roborazzi tasks. Baselines live in `gravatar-ui/screenshotTests/roborazzi/` and `gravatar-quickeditor/screenshotTests/roborazzi/`.
 - **Binary compatibility**: Public API changes require running `./gradlew apiDump` to update `.api` files. CI enforces compatibility via `apiCheck`.
 - **Explicit API mode**: Enabled in strict mode for library modules — all public declarations require explicit visibility modifiers. See [Explicit API mode](docs/sdk-technical-details/sdk-technical-details.md#explicit-api-mode).
-- **`secrets.properties`**: Required for the demo app but managed via `.configure` — never commit actual secrets.
+- **`secrets.properties`**: Required for the demo app but decrypted outside the checkout by `a8c-secrets decrypt` — never commit actual secrets.
diff --git a/demo-app/build.gradle.kts b/demo-app/build.gradle.kts
index 6456856bf..be5cd291c 100644
--- a/demo-app/build.gradle.kts
+++ b/demo-app/build.gradle.kts
@@ -12,11 +12,17 @@ plugins {
 }
 
 fun secretProperties(): Properties {
+    val repoId = rootProject.file(".a8c-secrets/repo-id").readText().trim()
+    val a8cSecretsFile = File(System.getProperty("user.home"), ".a8c-secrets/$repoId/secrets.properties")
+    val localSecretsFile = rootProject.file("secrets.properties")
+
     val properties = Properties()
-    rootProject.file("secrets.properties")
-        .takeIf { it.exists() }
+    listOf(a8cSecretsFile, localSecretsFile)
+        .firstOrNull { it.exists() }
         ?.let { properties.load(FileInputStream(it)) }
-        ?: logger.warn("Secret properties file not found. Quick Editor won't work properly.")
+        ?: logger.warn(
+            "$a8cSecretsFile not found. Run `a8c-secrets decrypt`, or Quick Editor won't work properly.",
+        )
     return properties
 }