diff --git a/makefiles/kube.make b/makefiles/kube.make
index 31d40e5..7d4eaed 100644
--- a/makefiles/kube.make
+++ b/makefiles/kube.make
@@ -9,6 +9,28 @@ kube_tools := $(SHIPKIT_BIN)/kube_tools
 help.kube:
 	$(MAKE) help HELP_REGEX="^kube.+.*"
 
+# ===== SUBHELP TARGETS ==========
+# Trying to cut clutter in kube targets by categorizing them.
+# Note that the help regex for these targets is not the same as the target!
+
+## Show the available subhelp categories for help.kube
+help.kube.subhelp: 
+	$(MAKE) help HELP_REGEX="^subhelp.kube.+.*"
+
+# kube.deploy targets apply full deployments or cronjobs to k8s
+subhelp.kube.deploy:
+	$(MAKE) help HELP_REGEX="^kube.deploy.+.*"
+
+# kube.kustomize targets apply kustomization directories to the cluster.
+subhelp.kube.kustomize:
+	$(MAKE) help HELP_REGEX="^kube.kustomize.+.*"
+
+# kube.set targets apply secrets and configmaps outside of a deployment.
+subhelp.kube.set:
+	$(MAKE) help HELP_REGEX="^kube.set.+.*"
+
+# ===== END SUBHELP TARGETS ==========
+
 # removes everything with the app=$(APP_KEY) under $(APP_KUBE_NAMESPACE)
 kube.clean: | _verify_APP_KUBE_NAMESPACE
 	$(kube_tools) ctl delete deployment,svc,configmap,ingress --selector="app=$(APP_KEY)" --namespace="$(APP_KUBE_NAMESPACE)"
diff --git a/makefiles/vault.make b/makefiles/vault.make
index 3936f89..7be22df 100644
--- a/makefiles/vault.make
+++ b/makefiles/vault.make
@@ -66,8 +66,8 @@ vault.decrypt: $(VAULT_DIR)
 $(VAULT_DIR): | $(SOP_SH) vault.gpg.import-private-key vault.clone
 	cd $(VAULT_DIR)
 	for vfile in $(VAULT_FILES); do
-		outFile="$${vfile/.enc./.}" # remove .enc.
-		outFile="$${outFile/.encrypted./.}" # remove .encrypted.
+		# Remove any .enc or .encrypted limited by literal dot and word boundary at end
+		outFile="$$(sed -E s/\.\(encrypted\|enc\)\\b//g <<< $$vfile )"
 		$(logr) "$$vfile > $$outFile"
 		$(SOP_SH) -d $$vfile > $$outFile
 	done