From cecfd8b0e4398cf6d1c5c141d53d37cf94d1907e Mon Sep 17 00:00:00 2001
From: dtoro <d.toro.v@pm.me>
Date: Sat, 8 Aug 2026 21:07:51 +0200
Subject: [PATCH] =?UTF-8?q?0.27.4=20=E2=80=94=20fix:=20StartRefreshLoop=20?=
 =?UTF-8?q?was=20blocking=20startup,=20wrap=20in=20goroutine?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 VERSION                    | 2 +-
 internal/httpapi/server.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/VERSION b/VERSION
index d0ca6fd..49f074d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.27.3
\ No newline at end of file
+0.27.4
\ No newline at end of file
diff --git a/internal/httpapi/server.go b/internal/httpapi/server.go
index e472431..8610e92 100644
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -96,9 +96,9 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 		s.secretsManager = secrets.NewManager(primary, fallback)
 		slog.Info("secrets backend wired", "backend", "infisical+sops", "site", cfg.InfisicalSiteURL)
 
-		// Start background secret refresh loop.
+		// Start background secret refresh loop (non-blocking).
 		if mgr, ok := s.secretsManager.(*secrets.Manager); ok {
-			mgr.StartRefreshLoop(ctx)
+			safego.Go("secrets:refresh", func() { mgr.StartRefreshLoop(ctx) })
 		}
 
 		// Pre-load SSH host keys from Infisical for host verification.