diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index efe227cb7..f07e9ba55 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -757,7 +757,7 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ runner.temp }}/podman-linux-amd64.tar.gz
-          key: ${{ runner.os }}-${{ runner.arch }}-podman-static-v5.8.4
+          key: ${{ runner.os }}-${{ runner.arch }}-podman-static-v5.8.4-sha256-v2
 
       - name: install podman (Linux)
         if: (matrix.install-podman == 'rootless' || matrix.install-podman == 'rootful') && runner.os == 'Linux'
diff --git a/cmd/secrets/list.go b/cmd/secrets/list.go
index 90ba14014..0d4bb7196 100644
--- a/cmd/secrets/list.go
+++ b/cmd/secrets/list.go
@@ -37,6 +37,7 @@ func NewListCmd(flags *flags.GlobalFlags) *cobra.Command {
 type secretEntry struct {
 	Name     string `json:"name"`
 	Context  string `json:"context"`
+	Backend  string `json:"backend,omitempty"`
 	Created  string `json:"created,omitempty"`
 	LastUsed string `json:"lastUsed,omitempty"`
 	Orphaned bool   `json:"orphaned,omitempty"`
@@ -93,6 +94,7 @@ func renderJSON(metas []secrets.SecretMeta) error {
 		entries = append(entries, secretEntry{
 			Name:     m.Name,
 			Context:  m.Context,
+			Backend:  string(m.Backend),
 			Created:  formatTime(m.Created),
 			LastUsed: formatTime(m.LastUsed),
 			Orphaned: m.Orphaned,
@@ -117,7 +119,7 @@ func formatTime(t time.Time) string {
 
 func orphanLabel(orphaned bool) string {
 	if orphaned {
-		return "orphaned"
+		return "missing value"
 	}
 	return "ok"
 }
diff --git a/desktop/src/main/ipc.ts b/desktop/src/main/ipc.ts
index 3cd27d01a..5a6cd3a8a 100644
--- a/desktop/src/main/ipc.ts
+++ b/desktop/src/main/ipc.ts
@@ -42,6 +42,7 @@ interface SecretEntry {
   created?: string
   lastUsed?: string
   orphaned?: boolean
+  backend?: "keyring" | "file"
 }
 
 interface EnvEntry {
diff --git a/desktop/src/renderer/src/lib/stores/secrets.test.ts b/desktop/src/renderer/src/lib/stores/secrets.test.ts
index 6cff95c59..32f2bec13 100644
--- a/desktop/src/renderer/src/lib/stores/secrets.test.ts
+++ b/desktop/src/renderer/src/lib/stores/secrets.test.ts
@@ -6,6 +6,7 @@ import {
   initSecrets,
   refreshSecrets,
   secrets,
+  secretsError,
   secretsLoading,
 } from "./secrets.js"
 
@@ -13,6 +14,7 @@ describe("secrets store", () => {
   beforeEach(() => {
     resetTauriMocks()
     secrets.set([])
+    secretsError.set(null)
     secretsLoading.set(true)
   })
 
@@ -36,6 +38,19 @@ describe("secrets store", () => {
 
     expect(get(secretsLoading)).toBe(false)
     expect(get(secrets)).toEqual([])
+    expect(get(secretsError)).toBe("IPC not available")
+  })
+
+  it("clears the init error after a successful retry", async () => {
+    mockInvoke
+      .mockRejectedValueOnce(new Error("IPC not available"))
+      .mockResolvedValueOnce([{ name: "TOKEN", context: "default" }])
+
+    await initSecrets()
+    expect(get(secretsError)).toBe("IPC not available")
+
+    await initSecrets()
+    expect(get(secretsError)).toBeNull()
   })
 
   it("refreshSecrets updates the store", async () => {
@@ -46,4 +61,16 @@ describe("secrets store", () => {
     expect(get(secrets)).toHaveLength(1)
     expect(get(secrets)[0].name).toBe("TOKEN")
   })
+
+  it("clears the refresh error after a successful retry", async () => {
+    mockInvoke
+      .mockRejectedValueOnce(new Error("IPC not available"))
+      .mockResolvedValueOnce([{ name: "TOKEN", context: "default" }])
+
+    await refreshSecrets()
+    expect(get(secretsError)).toBe("IPC not available")
+
+    await refreshSecrets()
+    expect(get(secretsError)).toBeNull()
+  })
 })
diff --git a/desktop/src/renderer/src/lib/stores/secrets.ts b/desktop/src/renderer/src/lib/stores/secrets.ts
index 14b5333d1..2b98afcbe 100644
--- a/desktop/src/renderer/src/lib/stores/secrets.ts
+++ b/desktop/src/renderer/src/lib/stores/secrets.ts
@@ -4,12 +4,14 @@ import type { Secret } from "$lib/types/index.js"
 
 export const secrets = writable<Secret[]>([])
 export const secretsLoading = writable(true)
+export const secretsError = writable<string | null>(null)
 
 export async function refreshSecrets(): Promise<void> {
   try {
     secrets.set(await secretList())
-  } catch {
-    // IPC not available
+    secretsError.set(null)
+  } catch (err) {
+    secretsError.set(err instanceof Error ? err.message : String(err))
   }
 }
 
@@ -17,8 +19,9 @@ export async function initSecrets(): Promise<void> {
   secretsLoading.set(true)
   try {
     secrets.set(await secretList())
-  } catch {
-    // IPC not available
+    secretsError.set(null)
+  } catch (err) {
+    secretsError.set(err instanceof Error ? err.message : String(err))
   } finally {
     secretsLoading.set(false)
   }
diff --git a/desktop/src/renderer/src/lib/types/index.ts b/desktop/src/renderer/src/lib/types/index.ts
index 45f7a17a3..10c2b6f9b 100644
--- a/desktop/src/renderer/src/lib/types/index.ts
+++ b/desktop/src/renderer/src/lib/types/index.ts
@@ -151,6 +151,7 @@ export interface Secret {
   created?: string
   lastUsed?: string
   orphaned?: boolean
+  backend?: "keyring" | "file"
 }
 
 export interface EnvVar {
diff --git a/desktop/src/renderer/src/pages/SecretsPage.svelte b/desktop/src/renderer/src/pages/SecretsPage.svelte
index 19ce8eb75..75f4f0e6d 100644
--- a/desktop/src/renderer/src/pages/SecretsPage.svelte
+++ b/desktop/src/renderer/src/pages/SecretsPage.svelte
@@ -7,7 +7,7 @@ import { badgeVariants } from "$lib/components/ui/badge/index.js"
 import * as Dialog from "$lib/components/ui/dialog/index.js"
 import ConfirmDialog from "$lib/components/layout/ConfirmDialog.svelte"
 import CardSkeleton from "$lib/components/ui/skeleton/CardSkeleton.svelte"
-import { secrets, secretsLoading, refreshSecrets } from "$lib/stores/secrets.js"
+import { secrets, secretsError, secretsLoading, refreshSecrets } from "$lib/stores/secrets.js"
 import { secretSet, secretDelete } from "$lib/ipc/commands.js"
 import { toasts } from "$lib/stores/toasts.js"
 import { extractErrorMessage } from "$lib/utils/error.js"
@@ -102,7 +102,7 @@ async function confirmDelete() {
         <Dialog.Header>
           <Dialog.Title>{nameExists ? "Replace Secret" : "Add Secret"}</Dialog.Title>
           <Dialog.Description>
-            Stored in your OS keyring and injected into workspaces on demand.
+            Stored securely in your configured Devsy secrets backend and injected into workspaces on demand.
           </Dialog.Description>
         </Dialog.Header>
         <form onsubmit={(e) => { e.preventDefault(); handleCreate() }} class="space-y-4">
@@ -158,6 +158,10 @@ async function confirmDelete() {
         <CardSkeleton />
       {/each}
     </div>
+  {:else if $secretsError}
+    <div class="rounded-xl border border-destructive/50 bg-destructive/10 p-4 text-sm text-destructive">
+      Unable to load secrets: {$secretsError}
+    </div>
   {:else if $secrets.length === 0}
     <div class="flex flex-col items-center justify-center gap-4 py-16 text-center">
       <KeyRound class="h-10 w-10 text-muted-foreground" />
@@ -189,7 +193,7 @@ async function confirmDelete() {
               </div>
               <div class="flex items-center gap-1.5 shrink-0">
                 {#if secret.orphaned}
-                  <span class={badgeVariants({ variant: "destructive" })}>orphaned</span>
+                  <span class={badgeVariants({ variant: "destructive" })} title={`Devsy has metadata for this secret, but its value is missing from the ${secret.backend ?? "configured"} backend.`}>Missing value</span>
                 {/if}
                 <Button variant="ghost" size="icon" aria-label="Delete secret" onclick={(e) => requestDelete(e, secret.name)}>
                   <Trash2 class="h-4 w-4" />
diff --git a/pkg/secrets/backend_registry.go b/pkg/secrets/backend_registry.go
new file mode 100644
index 000000000..cb936a181
--- /dev/null
+++ b/pkg/secrets/backend_registry.go
@@ -0,0 +1,124 @@
+package secrets
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"filippo.io/age"
+)
+
+type backendRegistry interface {
+	Open(kind Backend, idx *index, create bool) (backend, error)
+	ResolveForNewSecret(preference Backend, idx *index) (Backend, error)
+}
+
+type fixedBackendRegistry struct{ b backend }
+
+func (r fixedBackendRegistry) Open(_ Backend, _ *index, _ bool) (backend, error) { return r.b, nil }
+func (r fixedBackendRegistry) ResolveForNewSecret(_ Backend, _ *index) (Backend, error) {
+	return BackendKeyring, nil
+}
+
+type systemBackendRegistry struct{ dir string }
+
+func newSystemBackendRegistry(
+	dir string,
+) backendRegistry {
+	return &systemBackendRegistry{dir: dir}
+}
+
+func (r *systemBackendRegistry) Open(kind Backend, idx *index, create bool) (backend, error) {
+	switch kind {
+	case BackendKeyring:
+		return keyringBackend{}, nil
+	case BackendFile:
+		var key *fileKey
+		var err error
+		if create {
+			key, err = resolveFileKey(r.dir, os.Getenv(EnvPassphrase))
+		} else {
+			key, err = openExistingFileKey(r.dir, idx)
+		}
+		if err != nil {
+			return nil, err
+		}
+		if create && idx != nil {
+			idx.data.KeySource = string(key.source)
+		}
+		return newFileBackend(filepath.Join(r.dir, EncryptedFileName), key), nil
+	default:
+		return nil, fmt.Errorf("invalid secrets backend %q", kind)
+	}
+}
+
+func (r *systemBackendRegistry) ResolveForNewSecret(
+	preference Backend,
+	idx *index,
+) (Backend, error) {
+	switch preference {
+	case BackendKeyring:
+		return BackendKeyring, nil
+	case BackendFile:
+		return BackendFile, nil
+	case BackendAuto:
+		if keyringAvailable() {
+			return BackendKeyring, nil
+		}
+		return BackendFile, nil
+	default:
+		return "", fmt.Errorf("invalid secrets backend %q", preference)
+	}
+}
+
+func openExistingFileKey(dir string, idx *index) (*fileKey, error) {
+	source := keySource(idx.data.KeySource)
+	if source == "" {
+		return nil, fmt.Errorf("encrypted secrets are missing their key source metadata")
+	}
+	if source == keySourcePassphrase {
+		return openPassphraseFileKey()
+	}
+	var store keyStore
+	switch source {
+	case keySourceKeyring:
+		store = keyringKeyStore{}
+	case keySourceAutoFile:
+		store = fileKeyStore{path: filepath.Join(dir, KeyFileName)}
+	default:
+		return nil, fmt.Errorf("invalid secrets key source %q", source)
+	}
+	return keyFromStore(store, source)
+}
+
+func openPassphraseFileKey() (*fileKey, error) {
+	passphrase := os.Getenv(EnvPassphrase)
+	if passphrase == "" {
+		return nil, fmt.Errorf("encrypted secrets require %s", EnvPassphrase)
+	}
+	recipient, err := age.NewScryptRecipient(passphrase)
+	if err != nil {
+		return nil, err
+	}
+	identity, err := age.NewScryptIdentity(passphrase)
+	if err != nil {
+		return nil, err
+	}
+	return &fileKey{recipient: recipient, identity: identity, source: keySourcePassphrase}, nil
+}
+
+func keyFromStore(store keyStore, source keySource) (*fileKey, error) {
+	encoded, err := store.load()
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(encoded) == "" {
+		return nil, ErrSecretNotFound
+	}
+	identity, err := age.ParseX25519Identity(strings.TrimSpace(encoded))
+	if err != nil {
+		return nil, fmt.Errorf("parse stored secrets key: %w", err)
+	}
+	return &fileKey{recipient: identity.Recipient(), identity: identity, source: source}, nil
+}
diff --git a/pkg/secrets/index.go b/pkg/secrets/index.go
index a95d2e26e..6b9ec2646 100644
--- a/pkg/secrets/index.go
+++ b/pkg/secrets/index.go
@@ -40,6 +40,9 @@ func loadIndex(path string) (*index, error) {
 		idx.data.Contexts = map[string]map[string]SecretMeta{}
 	}
 	idx.normalizeKinds()
+	if err := idx.validateBackends(); err != nil {
+		return nil, err
+	}
 
 	return idx, nil
 }
@@ -58,6 +61,47 @@ func (i *index) normalizeKinds() {
 	}
 }
 
+func (i *index) validateBackends() error {
+	for context, entries := range i.data.Contexts {
+		for name, meta := range entries {
+			if err := validateBackend(context, name, meta); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func validateBackend(context, name string, meta SecretMeta) error {
+	if meta.Kind == KindEnv {
+		if meta.Backend != "" {
+			return fmt.Errorf(
+				"invalid backend %q for environment entry %s/%s",
+				meta.Backend,
+				context,
+				name,
+			)
+		}
+		return nil
+	}
+	if meta.Backend == "" {
+		return fmt.Errorf(
+			"secret %s/%s is missing persisted backend ownership",
+			context,
+			name,
+		)
+	}
+	if meta.Backend != BackendKeyring && meta.Backend != BackendFile {
+		return fmt.Errorf(
+			"invalid secrets backend %q for %s/%s",
+			meta.Backend,
+			context,
+			name,
+		)
+	}
+	return nil
+}
+
 func (i *index) save() error {
 	out, err := yaml.Marshal(i.data)
 	if err != nil {
diff --git a/pkg/secrets/local_store.go b/pkg/secrets/local_store.go
index 9ce3597c8..9ff05ddab 100644
--- a/pkg/secrets/local_store.go
+++ b/pkg/secrets/local_store.go
@@ -27,13 +27,11 @@ const (
 )
 
 type localStore struct {
-	backend   backend
-	indexPath string
-	now       func() time.Time
-
-	// keySource is empty for the keyring backend; checked against the index so a
-	// key-source change is a clear error rather than a decryption failure.
-	keySource keySource
+	preference Backend
+	backends   backendRegistry
+	indexPath  string
+	now        func() time.Time
+	keySource  keySource
 }
 
 func NewStoreForConfig(devsyConfig *config.Config) (Store, error) {
@@ -44,18 +42,8 @@ func NewStoreForConfig(devsyConfig *config.Config) (Store, error) {
 	dir := filepath.Dir(configPath)
 	indexPath := filepath.Join(dir, IndexFileName)
 
-	switch resolveBackend(devsyConfig) {
-	case BackendKeyring:
-		return newLocalStore(keyringBackend{}, indexPath), nil
-	case BackendFile:
-		return newFileStore(dir, indexPath)
-	default:
-		if keyringAvailable() {
-			return newLocalStore(keyringBackend{}, indexPath), nil
-		}
-
-		return newFileStore(dir, indexPath)
-	}
+	return newLocalStoreWithRegistry(resolveBackend(devsyConfig), indexPath,
+		newSystemBackendRegistry(dir)), nil
 }
 
 func resolveBackend(devsyConfig *config.Config) Backend {
@@ -81,21 +69,21 @@ func normalizeBackend(value string) Backend {
 	}
 }
 
-func newFileStore(dir, indexPath string) (Store, error) {
-	key, err := resolveFileKey(dir, os.Getenv(EnvPassphrase))
-	if err != nil {
-		return nil, err
-	}
-
-	fb := newFileBackend(filepath.Join(dir, EncryptedFileName), key)
-	s := newLocalStore(fb, indexPath)
-	s.keySource = key.source
-
-	return s, nil
+func newLocalStore(b backend, indexPath string) *localStore {
+	return newLocalStoreWithRegistry(BackendKeyring, indexPath, fixedBackendRegistry{b: b})
 }
 
-func newLocalStore(b backend, indexPath string) *localStore {
-	return &localStore{backend: b, indexPath: indexPath, now: time.Now}
+func newLocalStoreWithRegistry(
+	preference Backend,
+	indexPath string,
+	backends backendRegistry,
+) *localStore {
+	return &localStore{
+		preference: preference,
+		backends:   backends,
+		indexPath:  indexPath,
+		now:        time.Now,
+	}
 }
 
 func (s *localStore) Set(context, name, value string, kind Kind) error {
@@ -119,6 +107,9 @@ func (s *localStore) Set(context, name, value string, kind Kind) error {
 		meta = SecretMeta{Name: name, Context: context, Created: s.now().UTC()}
 	}
 	wasSensitive := exists && meta.Sensitive()
+	if wasSensitive && meta.Backend == "" {
+		return fmt.Errorf("secret %q is missing persisted backend ownership", name)
+	}
 	meta.Kind = kind
 	meta.Value = value
 
@@ -126,7 +117,12 @@ func (s *localStore) Set(context, name, value string, kind Kind) error {
 		return err
 	}
 	if meta.Sensitive() {
+		if err := s.checkKeySource(idx); err != nil {
+			return err
+		}
 		meta.Value = ""
+	} else {
+		meta.Backend = ""
 	}
 
 	idx.put(meta)
@@ -153,7 +149,14 @@ func (s *localStore) Get(context, name string) (string, error) {
 		if err := s.checkKeySource(idx); err != nil {
 			return "", err
 		}
-		if value, err = s.backend.get(backendKey(context, name)); err != nil {
+		if meta.Backend == "" {
+			return "", fmt.Errorf("secret %q is missing persisted backend ownership", name)
+		}
+		b, err := s.backends.Open(meta.Backend, idx, false)
+		if err != nil {
+			return "", err
+		}
+		if value, err = b.get(backendKey(context, name)); err != nil {
 			return "", err
 		}
 	} else {
@@ -182,11 +185,17 @@ func (s *localStore) Delete(context, name string) error {
 	}
 
 	if meta, ok := idx.get(context, name); ok && meta.Sensitive() {
-		if err := s.checkKeySource(idx); err != nil {
-			return err
+		if meta.Backend == "" {
+			return fmt.Errorf("secret %q is missing persisted backend ownership", name)
 		}
-		if err := s.backend.remove(backendKey(context, name)); err != nil {
-			return err
+		if meta.Backend != "" {
+			b, openErr := s.backends.Open(meta.Backend, idx, false)
+			if openErr != nil {
+				return openErr
+			}
+			if err := b.remove(backendKey(context, name)); err != nil {
+				return err
+			}
 		}
 	}
 	idx.remove(context, name)
@@ -208,8 +217,8 @@ func (s *localStore) Meta(context, name string) (SecretMeta, error) {
 	return meta, nil
 }
 
-// List returns the context's entries, flagging any sensitive entry whose backend
-// value is missing (orphaned).
+// List returns the context's entries, flagging sensitive entries whose owned
+// backend value is missing.
 func (s *localStore) List(context string) ([]SecretMeta, error) {
 	idx, err := loadIndex(s.indexPath)
 	if err != nil {
@@ -220,19 +229,24 @@ func (s *localStore) List(context string) ([]SecretMeta, error) {
 	if !anySensitive(entries) {
 		return entries, nil
 	}
-	if err := s.checkKeySource(idx); err != nil {
-		return nil, err
-	}
-
 	for i := range entries {
 		if !entries[i].Sensitive() {
 			continue
 		}
-		orphaned, err := s.isOrphaned(context, entries[i].Name)
+		meta := entries[i]
+		if meta.Backend == "" {
+			return nil, fmt.Errorf("secret %q is missing persisted backend ownership", meta.Name)
+		}
+		b, err := s.backends.Open(meta.Backend, idx, false)
 		if err != nil {
 			return nil, err
 		}
-		entries[i].Orphaned = orphaned
+		_, err = b.get(backendKey(context, entries[i].Name))
+		if errors.Is(err, ErrSecretNotFound) {
+			entries[i].Orphaned = true
+		} else if err != nil {
+			return nil, err
+		}
 	}
 
 	return entries, nil
@@ -273,55 +287,60 @@ func anySensitive(entries []SecretMeta) bool {
 	return false
 }
 
-func (s *localStore) isOrphaned(context, name string) (bool, error) {
-	_, err := s.backend.get(backendKey(context, name))
-	switch {
-	case err == nil:
-		return false, nil
-	case errors.Is(err, ErrSecretNotFound):
-		return true, nil
-	default:
-		return false, fmt.Errorf("reconcile secret %q: %w", name, err)
+func (s *localStore) persistValue(
+	idx *index, meta *SecretMeta, value string, wasSensitive bool,
+) error {
+	if meta.Sensitive() {
+		return s.persistSensitive(idx, meta, value, !wasSensitive)
 	}
+	if wasSensitive {
+		return s.removeSensitive(idx, meta)
+	}
+	return nil
 }
 
-func (s *localStore) persistValue(
-	idx *index, meta *SecretMeta, value string, wasSensitive bool,
+func (s *localStore) persistSensitive(
+	idx *index, meta *SecretMeta, value string, create bool,
 ) error {
-	key := backendKey(meta.Context, meta.Name)
-	if meta.Sensitive() || wasSensitive {
-		if err := s.checkKeySource(idx); err != nil {
+	if meta.Backend == "" {
+		resolved, err := s.backends.ResolveForNewSecret(s.preference, idx)
+		if err != nil {
 			return err
 		}
+		meta.Backend = resolved
 	}
-	if meta.Sensitive() {
-		if err := s.backend.set(key, value); err != nil {
-			return err
-		}
-		if s.keySource != "" {
-			idx.data.KeySource = string(s.keySource)
-		}
-		return nil
+	b, err := s.backends.Open(meta.Backend, idx, create)
+	if err != nil {
+		return err
 	}
-	if wasSensitive {
-		return s.backend.remove(key)
+	if err := b.set(backendKey(meta.Context, meta.Name), value); err != nil {
+		return err
+	}
+	if s.keySource != "" {
+		idx.data.KeySource = string(s.keySource)
 	}
 	return nil
 }
 
-// checkKeySource rejects a key-source change with a clear error instead of a
-// downstream decryption failure.
-func (s *localStore) checkKeySource(idx *index) error {
-	if s.keySource == "" || idx.data.KeySource == "" {
-		return nil
+func (s *localStore) removeSensitive(idx *index, meta *SecretMeta) error {
+	if err := s.checkKeySource(idx); err != nil {
+		return err
 	}
-	if idx.data.KeySource != string(s.keySource) {
-		return fmt.Errorf(
-			"secrets were encrypted with the %q key source but the current source is %q; "+
-				"restore the original DEVSY_SECRETS_PASSPHRASE (or unset it) or re-create the secrets",
-			idx.data.KeySource, s.keySource,
-		)
+	b, err := s.backends.Open(meta.Backend, idx, false)
+	if err != nil {
+		return err
 	}
+	return b.remove(backendKey(meta.Context, meta.Name))
+}
 
-	return nil
+func (s *localStore) checkKeySource(idx *index) error {
+	if s.keySource == "" || idx.data.KeySource == "" || idx.data.KeySource == string(s.keySource) {
+		return nil
+	}
+	return fmt.Errorf(
+		"secrets were encrypted with the %q key source but the current source is %q; "+
+			"restore the original DEVSY_SECRETS_PASSPHRASE (or unset it) or re-create the secrets",
+		idx.data.KeySource,
+		s.keySource,
+	)
 }
diff --git a/pkg/secrets/store.go b/pkg/secrets/store.go
index 830b66e3e..8c8527153 100644
--- a/pkg/secrets/store.go
+++ b/pkg/secrets/store.go
@@ -43,6 +43,7 @@ type SecretMeta struct {
 	Value    string    `json:"value,omitempty"`
 	Created  time.Time `json:"created"`
 	LastUsed time.Time `json:"lastUsed,omitzero"`
+	Backend  Backend   `json:"backend,omitempty"`
 
 	Orphaned bool `json:"-"`
 }
diff --git a/pkg/secrets/store_internal_test.go b/pkg/secrets/store_internal_test.go
index 355af1a66..44c833336 100644
--- a/pkg/secrets/store_internal_test.go
+++ b/pkg/secrets/store_internal_test.go
@@ -2,6 +2,7 @@ package secrets
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -9,6 +10,7 @@ import (
 
 	"filippo.io/age"
 	"github.com/devsy-org/devsy/pkg/config"
+	"github.com/stretchr/testify/require"
 )
 
 const testContext = "default"
@@ -75,6 +77,25 @@ type mapBackend struct {
 
 func newMapBackend() *mapBackend { return &mapBackend{values: map[string]string{}} }
 
+type mapBackendRegistry struct {
+	backends map[Backend]*mapBackend
+}
+
+func (r mapBackendRegistry) Open(kind Backend, _ *index, _ bool) (backend, error) {
+	b, ok := r.backends[kind]
+	if !ok {
+		return nil, fmt.Errorf("missing test backend %q", kind)
+	}
+	return b, nil
+}
+
+func (r mapBackendRegistry) ResolveForNewSecret(preference Backend, _ *index) (Backend, error) {
+	if _, ok := r.backends[preference]; !ok {
+		return "", fmt.Errorf("missing test backend %q", preference)
+	}
+	return preference, nil
+}
+
 func (m *mapBackend) set(key, value string) error {
 	m.values[key] = value
 	return nil
@@ -179,7 +200,7 @@ func TestStore_ListSorted(t *testing.T) {
 	}
 }
 
-func TestStore_ReconcileFlagsOrphans(t *testing.T) {
+func TestStore_ListFlagsMissingValues(t *testing.T) {
 	mb := newMapBackend()
 	s := newTestStore(t, mb)
 
@@ -229,6 +250,39 @@ func TestStore_SetUpdatePreservesCreated(t *testing.T) {
 	}
 }
 
+func TestStore_UsesRecordedBackendAfterPreferenceChanges(t *testing.T) {
+	keyring := newMapBackend()
+	file := newMapBackend()
+	indexPath := filepath.Join(t.TempDir(), IndexFileName)
+	s := newLocalStoreWithRegistry(BackendKeyring, indexPath, mapBackendRegistry{
+		backends: map[Backend]*mapBackend{
+			BackendKeyring: keyring,
+			BackendFile:    file,
+		},
+	})
+
+	require.NoError(t, s.Set(testContext, "TOKEN", "v1", KindSecret))
+	meta, err := s.Meta(testContext, "TOKEN")
+	require.NoError(t, err)
+	require.Equal(t, BackendKeyring, meta.Backend)
+
+	s.preference = BackendFile
+	got, err := s.Get(testContext, "TOKEN")
+	require.NoError(t, err)
+	require.Equal(t, "v1", got)
+	require.NoError(t, s.Set(testContext, "TOKEN", "v2", KindSecret))
+	list, err := s.List(testContext)
+	require.NoError(t, err)
+	require.Len(t, list, 1)
+	require.Equal(t, BackendKeyring, list[0].Backend)
+	got, err = s.Get(testContext, "TOKEN")
+	require.NoError(t, err)
+	require.Equal(t, "v2", got)
+	require.NoError(t, s.Delete(testContext, "TOKEN"))
+	require.NotContains(t, keyring.values, backendKey(testContext, "TOKEN"))
+	require.NotContains(t, file.values, backendKey(testContext, "TOKEN"))
+}
+
 func TestValidateName(t *testing.T) {
 	valid := []string{"API_KEY", "db_password", "TOKEN2", "a"}
 	for _, n := range valid {
@@ -349,49 +403,51 @@ func TestFileBackend_AutoKeyRoundTrip(t *testing.T) {
 	}
 }
 
-// An index entry with an unset Kind (e.g. written by an older layout) must be
-// read as a secret, never silently downgraded to a plaintext env var.
-func TestLoadIndex_UnsetKindNormalizesToSecret(t *testing.T) {
+func TestStore_RejectsMissingBackendOwnership(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
-	raw := "contexts:\n  default:\n    LEGACY:\n      name: LEGACY\n      context: default\n"
+	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n      context: default\n"
 	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
-	idx, err := loadIndex(path)
-	if err != nil {
-		t.Fatal(err)
+	s := newLocalStore(newMapBackend(), path)
+	if _, err := s.Get(
+		testContext,
+		"UNOWNED",
+	); err == nil ||
+		!strings.Contains(err.Error(), "missing persisted backend ownership") {
+		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
-	meta, ok := idx.get("default", "LEGACY")
-	if !ok {
-		t.Fatal("expected entry to load")
+}
+
+func TestLoadIndex_RejectsMissingBackendOwnership(t *testing.T) {
+	path := filepath.Join(t.TempDir(), IndexFileName)
+	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n      context: default\n"
+	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
+		t.Fatal(err)
 	}
-	if !meta.Sensitive() {
-		t.Fatalf("unset Kind must normalize to secret, got %q", meta.Kind)
+
+	if _, err := loadIndex(path); err == nil ||
+		!strings.Contains(err.Error(), "missing persisted backend ownership") {
+		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }
 
-// A blank-kind entry carrying an inline value (e.g. hand-edited) must be
-// normalized to a secret with the inline plaintext cleared, upholding the
-// invariant that sensitive values never persist inline.
-func TestLoadIndex_UnsetKindClearsInlineValue(t *testing.T) {
+func TestStore_RejectsInlineSecretWithoutOwnership(t *testing.T) {
 	path := filepath.Join(t.TempDir(), IndexFileName)
-	raw := "contexts:\n  default:\n    LEGACY:\n      name: LEGACY\n" +
+	raw := "contexts:\n  default:\n    UNOWNED:\n      name: UNOWNED\n" +
 		"      context: default\n      value: leaked\n"
 	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
-	idx, err := loadIndex(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	meta, _ := idx.get("default", "LEGACY")
-	if !meta.Sensitive() {
-		t.Fatalf("unset Kind must normalize to secret, got %q", meta.Kind)
-	}
-	if meta.Value != "" {
-		t.Fatalf("inline value must be cleared on normalize, got %q", meta.Value)
+	s := newLocalStore(newMapBackend(), path)
+	if _, err := s.Get(
+		testContext,
+		"UNOWNED",
+	); err == nil ||
+		!strings.Contains(err.Error(), "missing persisted backend ownership") {
+		t.Fatalf("expected missing backend ownership error, got %v", err)
 	}
 }
 
diff --git a/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx b/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx
index 8b6b83e00..3c8badc30 100644
--- a/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx
+++ b/sites/docs-devsy-sh/content/docs/developing-in-workspaces/secrets.mdx
@@ -55,8 +55,9 @@ devsy secret get DB_PASSWORD
 devsy secret delete DB_PASSWORD
 ```
 
-`devsy secret list` never prints values. A value removed from the OS keyring
-outside Devsy is shown as `orphaned`.
+`devsy secret list` never prints values. A value missing from its recorded
+backend is shown as `Missing value`. Backend access failures, such as a locked
+keychain or decryption failure, are reported as errors instead.
 
 ## External Secret Sources
 
@@ -300,7 +301,8 @@ For Devsy-managed values, use the supported backends:
 - `keyring` — the OS keyring (Keychain / Credential Manager / libsecret).
 - `file` — an [age](https://age-encryption.org)-encrypted `secrets.enc` stored
   alongside the Devsy config.
-- `auto` — use the keyring when available and otherwise fall back to `file`.
+- `auto` — choose the keyring when available and otherwise fall back to `file`
+  for new secrets.
 
 Set a persistent preference per context with:
 
@@ -310,6 +312,10 @@ devsy context set -o SECRETS_BACKEND=file
 
 Or override it for one command with `DEVSY_SECRETS_BACKEND`.
 
+These settings select storage only when a new Devsy-managed secret is created.
+After creation, the concrete backend is recorded in `secrets.yaml` and the
+secret stays there even if the preference changes.
+
 The local `file` backend generates and manages an encryption key automatically.
 For stronger at-rest protection, set a passphrase with
 `DEVSY_SECRETS_PASSPHRASE`; the derived encryption key is then not stored on