diff --git a/hosts/nb/modules/development/nvim/config/sops.lua b/hosts/nb/modules/development/nvim/config/sops.lua
index d642d05..9fae204 100644
--- a/hosts/nb/modules/development/nvim/config/sops.lua
+++ b/hosts/nb/modules/development/nvim/config/sops.lua
@@ -6,7 +6,6 @@ local sops_group = vim.api.nvim_create_augroup("SopsEncryption", { clear = true
 -- Pattern matching for secrets files
 local secrets_patterns = {
   "*/secrets.yaml",
-  "*secrets*.yaml",
 }
 
 -- Size limits to prevent memory issues and UI freezes
@@ -124,6 +123,12 @@ vim.api.nvim_create_autocmd("BufWriteCmd", {
     local filepath = vim.fn.expand("%:p")
 
     if is_secrets_file(filepath) then
+      -- Guard against double-execution
+      if currently_saving[filepath] then
+        return
+      end
+      currently_saving[filepath] = true
+
       -- Get current buffer content
       local lines = vim.api.nvim_buf_get_lines(0, 0, -1, false)
       local content = table.concat(lines, "\n")
@@ -137,6 +142,7 @@ vim.api.nvim_create_autocmd("BufWriteCmd", {
           vim.log.levels.ERROR
         )
         -- Don't write anything, leave buffer marked as modified
+        currently_saving[filepath] = nil
         return
       end
 
@@ -151,6 +157,7 @@ vim.api.nvim_create_autocmd("BufWriteCmd", {
       if not temp_f then
         vim.notify("SOPS: Failed to create temp file: " .. (temp_err or "unknown error"), vim.log.levels.ERROR)
         -- Don't write anything, leave buffer marked as modified
+        currently_saving[filepath] = nil
         return
       end
       temp_f:write(content)
@@ -199,17 +206,22 @@ vim.api.nvim_create_autocmd("BufWriteCmd", {
             else
               vim.notify("SOPS: Could not re-decrypt after save. Buffer may show encrypted content.", vim.log.levels.WARN)
             end
+            -- Clear guard after successful save
+            currently_saving[filepath] = nil
           else
             vim.notify("SOPS: Failed to write encrypted content: " .. (write_err or "unknown error"), vim.log.levels.ERROR)
             -- Don't mark as saved, keep buffer marked as modified
+            currently_saving[filepath] = nil
           end
         else
           vim.notify("SOPS: Failed to open file for writing: " .. (err or "unknown error"), vim.log.levels.ERROR)
           -- Don't mark as saved, keep buffer marked as modified
+          currently_saving[filepath] = nil
         end
       else
         vim.notify("SOPS: Failed to encrypt file - NOT SAVED! Error: " .. encrypted, vim.log.levels.ERROR)
         -- Don't write anything, leave buffer marked as modified
+        currently_saving[filepath] = nil
       end
     end
   end,