diff --git a/infra/terraform/envs/production/app-deps.tf b/infra/terraform/envs/production/app-deps.tf
index 94ce594..2b98c81 100644
--- a/infra/terraform/envs/production/app-deps.tf
+++ b/infra/terraform/envs/production/app-deps.tf
@@ -275,4 +275,14 @@ resource "aws_secretsmanager_secret" "app" {
 resource "aws_secretsmanager_secret_version" "app" {
   secret_id     = aws_secretsmanager_secret.app.id
   secret_string = jsonencode(local.app_secret_values)
+
+  # Terraform only *seeds* this secret on first creation. Runtime values
+  # (notably ENCRYPTION_KEY, plus anything set via the "Update app env vars"
+  # workflow) are managed out-of-band in Secrets Manager and must survive
+  # later applies. Without this, every apply rewrites the blob from
+  # local.app_secret_values — regenerating ENCRYPTION_KEY and orphaning all
+  # data already encrypted under the previous key.
+  lifecycle {
+    ignore_changes = [secret_string]
+  }
 }
diff --git a/infra/terraform/envs/sandbox/app-deps.tf b/infra/terraform/envs/sandbox/app-deps.tf
index 44db515..8bd103d 100644
--- a/infra/terraform/envs/sandbox/app-deps.tf
+++ b/infra/terraform/envs/sandbox/app-deps.tf
@@ -277,4 +277,14 @@ resource "aws_secretsmanager_secret" "app" {
 resource "aws_secretsmanager_secret_version" "app" {
   secret_id     = aws_secretsmanager_secret.app.id
   secret_string = jsonencode(local.app_secret_values)
+
+  # Terraform only *seeds* this secret on first creation. Runtime values
+  # (notably ENCRYPTION_KEY, plus anything set via the "Update app env vars"
+  # workflow) are managed out-of-band in Secrets Manager and must survive
+  # later applies. Without this, every apply rewrites the blob from
+  # local.app_secret_values — regenerating ENCRYPTION_KEY and orphaning all
+  # data already encrypted under the previous key.
+  lifecycle {
+    ignore_changes = [secret_string]
+  }
 }
diff --git a/infra/terraform/envs/test/app-deps.tf b/infra/terraform/envs/test/app-deps.tf
index 2dc4ad0..29d26d6 100644
--- a/infra/terraform/envs/test/app-deps.tf
+++ b/infra/terraform/envs/test/app-deps.tf
@@ -277,4 +277,14 @@ resource "aws_secretsmanager_secret" "app" {
 resource "aws_secretsmanager_secret_version" "app" {
   secret_id     = aws_secretsmanager_secret.app.id
   secret_string = jsonencode(local.app_secret_values)
+
+  # Terraform only *seeds* this secret on first creation. Runtime values
+  # (notably ENCRYPTION_KEY, plus anything set via the "Update app env vars"
+  # workflow) are managed out-of-band in Secrets Manager and must survive
+  # later applies. Without this, every apply rewrites the blob from
+  # local.app_secret_values — regenerating ENCRYPTION_KEY and orphaning all
+  # data already encrypted under the previous key.
+  lifecycle {
+    ignore_changes = [secret_string]
+  }
 }