The staged ladder is the right shape for this advice, especially putting SOPS + age before any managed store: it fixes the "secrets in git history" problem without adding a service to run. Two things I would add to the hygiene stage: the departing-teammate problem is usually worse than the laptop-count problem, so rotate on offboarding even before you have a vault, and add a pre-commit scan (gitleaks or similar) the same week, because the first real secret that lands in a public repo gets found by bots in minutes, not days. The CI/CD section is the one most small teams skip and should not.