diff --git a/schema/mise.json b/schema/mise.json
index c0ef0c903d..1bc0fe4da2 100644
--- a/schema/mise.json
+++ b/schema/mise.json
@@ -294,28 +294,6 @@
           "description": "Enable experimental mise features which are incomplete or unstable—breakings changes may occur",
           "type": "boolean"
         },
-        "sops": {
-          "additionalProperties": false,
-          "properties": {
-            "rops": {
-              "default": true,
-              "description": "Use rops to decrypt sops files. Disable to shell out to `sops` which will slow down mise but sops may offer features not available in rops.",
-              "type": "boolean"
-            },
-            "age_key": {
-              "description": "The age private key to use for sops secret decryption.",
-              "type": "string"
-            },
-            "age_key_file": {
-              "description": "Path to the age private key file to use for sops secret decryption.",
-              "type": "string"
-            },
-            "age_recipients": {
-              "description": "The age public keys to use for sops secret encryption.",
-              "type": "string"
-            }
-          }
-        },
         "fetch_remote_versions_cache": {
           "default": "1h",
           "description": "How long to cache remote versions for tools.",
@@ -680,6 +658,28 @@
           "description": "Suppress all `mise run|watch` output except errors—including what tasks output.",
           "type": "boolean"
         },
+        "sops": {
+          "additionalProperties": false,
+          "properties": {
+            "age_key": {
+              "description": "The age private key to use for sops secret decryption.",
+              "type": "string"
+            },
+            "age_key_file": {
+              "description": "Path to the age private key file to use for sops secret decryption.",
+              "type": "string"
+            },
+            "age_recipients": {
+              "description": "The age public keys to use for sops secret encryption.",
+              "type": "string"
+            },
+            "rops": {
+              "default": true,
+              "description": "Use rops to decrypt sops files. Disable to shell out to `sops` which will slow down mise but sops may offer features not available in rops.",
+              "type": "boolean"
+            }
+          }
+        },
         "status": {
           "additionalProperties": false,
           "properties": {
diff --git a/src/config/mod.rs b/src/config/mod.rs
index 7970220cf2..d179c9804f 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -218,14 +218,14 @@ impl Config {
             .get_or_try_init(|| ToolRequestSetBuilder::new().build())
     }
 
-    pub fn get_toolset(&self) -> eyre::Result<&Toolset> {
+    pub fn get_toolset(&self) -> Result<&Toolset> {
         self.toolset.get_or_try_init(|| {
             let mut ts = Toolset::from(self.get_tool_request_set()?.clone());
             ts.resolve()?;
             Ok(ts)
         })
     }
-
+    
     pub fn get_repo_url(&self, plugin_name: &str) -> Option<String> {
         let plugin_name = self
             .all_aliases
diff --git a/src/sops.rs b/src/sops.rs
index 757c30d6c6..dc25a61281 100644
--- a/src/sops.rs
+++ b/src/sops.rs
@@ -1,4 +1,4 @@
-use crate::config::SETTINGS;
+use crate::config::{Config, SETTINGS};
 use crate::file::replace_path;
 use crate::{dirs, file, result};
 use eyre::WrapErr;
@@ -66,10 +66,15 @@ where
             .wrap_err("failed to decrypt sops file")?
             .to_string()
     } else {
-        // TODO: this won't work right if sops is coming from mise since tools won't have been loaded
+        let config = Config::get();
+        let mut ts = config.get_tool_request_set().cloned().unwrap_or_default()
+            .filter_by_tool(["sops".into()].into())
+            .into_toolset();
+        ts.resolve()?;
+        let sops = ts.which_bin("sops").map(|s| s.to_string_lossy().to_string()).unwrap_or("sops".into());
         // TODO: this obviously won't work on windows
         cmd!(
-            "sops",
+            sops,
             "--input-type",
             format,
             "--output-type",
@@ -77,8 +82,8 @@ where
             "-d",
             "/dev/stdin"
         )
-        .stdin_bytes(input.as_bytes())
-        .read()?
+            .stdin_bytes(input.as_bytes())
+            .read()?
     };
 
     if let Some(age) = prev_age {
diff --git a/src/toolset/mod.rs b/src/toolset/mod.rs
index 6a3b6ed078..e1c49895ea 100644
--- a/src/toolset/mod.rs
+++ b/src/toolset/mod.rs
@@ -539,10 +539,12 @@ impl Toolset {
         self.list_current_installed_versions()
             .into_par_iter()
             .find_first(|(p, tv)| {
-                if let Ok(x) = p.which(tv, bin_name) {
-                    x.is_some()
-                } else {
-                    false
+                match p.which(tv, bin_name) {
+                    Ok(x) => x.is_some(),
+                    Err(e) => {
+                        debug!("Error running which: {:#}", e);
+                        false
+                    }
                 }
             })
     }
diff --git a/src/toolset/tool_request_set.rs b/src/toolset/tool_request_set.rs
index 63f6e83039..58f0445ba8 100644
--- a/src/toolset/tool_request_set.rs
+++ b/src/toolset/tool_request_set.rs
@@ -8,7 +8,7 @@ use crate::cli::args::{BackendArg, ToolArg};
 use crate::config::{Config, Settings};
 use crate::env;
 use crate::registry::REGISTRY;
-use crate::toolset::{ToolRequest, ToolSource};
+use crate::toolset::{ToolRequest, ToolSource, Toolset};
 
 #[derive(Debug, Default, Clone)]
 pub struct ToolRequestSet {
@@ -86,6 +86,10 @@ impl ToolRequestSet {
             .map(|(fa, trl, ts)| (fa.clone(), trl.clone(), ts.clone()))
             .collect::<ToolRequestSet>()
     }
+    
+    pub fn into_toolset(self) -> Toolset {
+        self.into()
+    }
 }
 
 impl Display for ToolRequestSet {