diff --git a/pkgs/sane-scripts/src/bin/sane-secrets-update-keys b/pkgs/sane-scripts/src/bin/sane-secrets-update-keys
index 9179e33f..390438b9 100755
--- a/pkgs/sane-scripts/src/bin/sane-secrets-update-keys
+++ b/pkgs/sane-scripts/src/bin/sane-secrets-update-keys
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # after modifying .sops.yaml, run this to re-encode all secrets to the new keys
 # pass the base directory (under which *everything* is a secret) as argument
-for i in $1/**/*
+for i in $(find "$1" -print)
 do
 	yes | sops updatekeys "$i"
 done