diff --git a/VERSION b/VERSION
index d0ca6fd..49f074d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.27.3
\ No newline at end of file
+0.27.4
\ No newline at end of file
diff --git a/internal/httpapi/server.go b/internal/httpapi/server.go
index e472431..8610e92 100644
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -96,9 +96,9 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 		s.secretsManager = secrets.NewManager(primary, fallback)
 		slog.Info("secrets backend wired", "backend", "infisical+sops", "site", cfg.InfisicalSiteURL)
 
-		// Start background secret refresh loop.
+		// Start background secret refresh loop (non-blocking).
 		if mgr, ok := s.secretsManager.(*secrets.Manager); ok {
-			mgr.StartRefreshLoop(ctx)
+			safego.Go("secrets:refresh", func() { mgr.StartRefreshLoop(ctx) })
 		}
 
 		// Pre-load SSH host keys from Infisical for host verification.