diff --git a/tools/secrets.sh b/tools/secrets.sh
index 87dba20..dc474d3 100755
--- a/tools/secrets.sh
+++ b/tools/secrets.sh
@@ -59,7 +59,16 @@ install_encrypted() {
 }
 
 workdir() { local d; d=$(mktemp -d "$DIR/.work.XXXXXX"); chmod 700 "$d"; echo "$d"; }
-scrub() { [ -n "${WD:-}" ] && { find "$WD" -type f -exec shred -u {} + 2>/dev/null || true; rm -rf "$WD"; }; }
+# NB: must return 0. As an EXIT trap its status becomes the script's status, and an
+# `[ -n "$WD" ] && ...` that is simply false would make every read-only command (get/list/verify)
+# exit 1 while printing a perfectly correct answer — a silent false failure in callers.
+scrub() {
+  if [ -n "${WD:-}" ]; then
+    find "$WD" -type f -exec shred -u {} + 2>/dev/null || true
+    rm -rf "$WD"
+  fi
+  return 0
+}
 trap scrub EXIT
 
 have_sops