diff --git a/bootstrap.sh b/bootstrap.sh
index 2dcdd0b..f99c569 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -133,6 +133,22 @@ fi
 if [ "$NO_SECRETS" -eq 0 ]; then
     for cmd in age sops; do command -v "$cmd" >/dev/null || missing+=("$cmd"); done
 fi
+# sops isn't a real Debian/Fedora package (there is no apt/dnf "sops"), so it
+# always needs the direct-binary-download path, on both distros. Only Darwin
+# (brew) can install it via a package manager.
+install_sops_binary() {
+    local sops_version=v3.9.4
+    local arch
+    arch="$(uname -m)"
+    case "$arch" in
+        x86_64|amd64) arch=amd64 ;;
+        aarch64|arm64) arch=arm64 ;;
+        *) echo "[bootstrap] unsupported arch for sops binary download: $arch" >&2; return 1 ;;
+    esac
+    curl -fsSL "https://github.com/getsops/sops/releases/download/${sops_version}/sops-${sops_version}.linux.${arch}" \
+        -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops
+}
+
 if [ "${#missing[@]}" -gt 0 ]; then
     if [ "$DRY_RUN" -eq 1 ]; then
         echo "+ would install missing tools: ${missing[*]}"
@@ -153,13 +169,23 @@ if [ "${#missing[@]}" -gt 0 ]; then
             for m in "${missing[@]}"; do
                 case "$m" in
                     python3-yaml) dnf_list+=("python3-pyyaml") ;;
+                    sops)         install_sops_binary ;;
                     *)            dnf_list+=("$m") ;;
                 esac
             done
-            dnf install -y "${dnf_list[@]}"
+            [ "${#dnf_list[@]}" -gt 0 ] && dnf install -y "${dnf_list[@]}"
         elif command -v apt-get >/dev/null 2>&1; then
-            DEBIAN_FRONTEND=noninteractive apt-get update
-            DEBIAN_FRONTEND=noninteractive apt-get install -y "${missing[@]}"
+            apt_list=()
+            for m in "${missing[@]}"; do
+                case "$m" in
+                    sops) install_sops_binary ;;
+                    *)    apt_list+=("$m") ;;
+                esac
+            done
+            if [ "${#apt_list[@]}" -gt 0 ]; then
+                DEBIAN_FRONTEND=noninteractive apt-get update
+                DEBIAN_FRONTEND=noninteractive apt-get install -y "${apt_list[@]}"
+            fi
         else
             echo "[bootstrap] no supported package manager for: ${missing[*]}" >&2
             echo "[bootstrap] install with your package manager + re-run" >&2