diff --git a/config/gpg_secret_backend/gpg.yaml b/config/gpg_secret_backend/gpg.yaml
index 4088b4b..c7ccc11 100644
--- a/config/gpg_secret_backend/gpg.yaml
+++ b/config/gpg_secret_backend/gpg.yaml
@@ -1,9 +1,4 @@
 # config/gpg_secret_backend/gpg.yaml
-# Registers the vault-plugin-secrets-gpg plugin and mounts it at "gpg".
-# The binary is installed on the OpenBao nodes by Puppet
-# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
-#
-# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
-# upgrade or OpenBao will refuse to launch the plugin.
+# Mounts the gpg secrets engine at "gpg". The plugin itself is registered in the
+# catalog separately (see config/plugins/vault-plugin-secrets-gpg.yaml).
 description: "GPG/OpenPGP secrets engine (sign/verify/encrypt/decrypt)"
-sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"
diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf
index f1766ba..9587959 100644
--- a/modules/vault_cluster/main.tf
+++ b/modules/vault_cluster/main.tf
@@ -341,8 +341,6 @@ module "gpg_secret_backend" {
 
   path        = each.key
   plugin      = each.value.plugin
-  command     = each.value.command
-  sha256      = each.value.sha256
   description = each.value.description
 }
 
diff --git a/modules/vault_cluster/modules/gpg_secret_backend/main.tf b/modules/vault_cluster/modules/gpg_secret_backend/main.tf
index 5a5cff2..39de702 100644
--- a/modules/vault_cluster/modules/gpg_secret_backend/main.tf
+++ b/modules/vault_cluster/modules/gpg_secret_backend/main.tf
@@ -1,20 +1,8 @@
-# Registers the GPG/OpenPGP secrets plugin in the catalog and mounts it. The
-# plugin binary is installed on the OpenBao nodes by Puppet
-# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg);
-# `command` is that filename, resolved relative to the server's plugin_directory.
-#
-# The sha256 is pinned here to the released binary. Puppet installs the RPM
-# floating, so on a plugin upgrade this sha256 must be bumped in lockstep or
-# OpenBao will refuse to launch the plugin.
-resource "vault_plugin" "this" {
-  type    = "secret"
-  name    = var.plugin
-  command = var.command
-  sha256  = var.sha256
-}
-
+# Mounts the gpg secrets engine. The plugin is registered ("imported") in the
+# catalog separately via the config/plugins/ discovery and the plugin module;
+# this module just enables a mount of the already-registered plugin type.
 resource "vault_mount" "this" {
   path        = var.path
-  type        = vault_plugin.this.name
+  type        = var.plugin
   description = var.description
 }
diff --git a/modules/vault_cluster/modules/gpg_secret_backend/variables.tf b/modules/vault_cluster/modules/gpg_secret_backend/variables.tf
index f3be158..849ee30 100644
--- a/modules/vault_cluster/modules/gpg_secret_backend/variables.tf
+++ b/modules/vault_cluster/modules/gpg_secret_backend/variables.tf
@@ -4,22 +4,11 @@ variable "path" {
 }
 
 variable "plugin" {
-  description = "Name to register the plugin under in the catalog (also the mount type)"
+  description = "Registered plugin name to mount (the catalog name = mount type)"
   type        = string
   default     = "vault-plugin-secrets-gpg"
 }
 
-variable "command" {
-  description = "Plugin binary filename, relative to the server plugin_directory"
-  type        = string
-  default     = "vault-plugin-secrets-gpg"
-}
-
-variable "sha256" {
-  description = "SHA-256 of the installed plugin binary; must match the on-disk binary or OpenBao rejects it"
-  type        = string
-}
-
 variable "description" {
   description = "Human-friendly description of the mount"
   type        = string
diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf
index e47dfe4..e72de66 100644
--- a/modules/vault_cluster/variables.tf
+++ b/modules/vault_cluster/variables.tf
@@ -316,11 +316,9 @@ variable "litellm_secret_backend_role" {
 }
 
 variable "gpg_secret_backend" {
-  description = "Map of GPG/OpenPGP secret engines to register + mount (path => plugin sha256 + config)"
+  description = "Map of GPG/OpenPGP secret engines to mount (path => registered plugin + description). The plugin is registered separately via config/plugins."
   type = map(object({
     plugin      = optional(string, "vault-plugin-secrets-gpg")
-    command     = optional(string, "vault-plugin-secrets-gpg")
-    sha256      = string
     description = optional(string)
   }))
   default = {}