diff --git a/sops/README.md b/sops/README.md
index f11832e..56eda85 100644
--- a/sops/README.md
+++ b/sops/README.md
@@ -2,4 +2,4 @@
 
 generate new age keys with `age-keygen -o ~/.config/sops/age/key-name.txt`. encrypt local secrets with `sops -e service-name/.env > service-name/.sops.env`.
 
-the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
+the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch (skipping the download when `sops` is already on `PATH`, e.g. on the custom `studio/actions:ubuntu-latest` runner image) and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
diff --git a/sops/action.yml b/sops/action.yml
index 0697166..d3942c6 100644
--- a/sops/action.yml
+++ b/sops/action.yml
@@ -1,5 +1,5 @@
 name: decrypt SOPS secrets
-description: installs SOPS and decrypts all *.sops.* files using an age key
+description: installs SOPS if missing and decrypts all *.sops.* files using an age key
 
 inputs:
   sops-age-key:
@@ -17,6 +17,8 @@ runs:
       run: |
         set -euo pipefail
 
+        command -v sops >/dev/null && exit 0
+
         os=$(uname -s | tr '[:upper:]' '[:lower:]')
         arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
         asset="sops-${SOPS_VERSION}.${os}.${arch}"