Render blueprints cannot attach environment groups — must be done manually in dashboard per service
Render's Infrastructure-as-Code blueprint (render.yaml) has no syntax for attaching environment groups (shared secret sets) to services. Environment groups must be attached manually via the Render dashboard after each new service is created or synced from the blueprint.
This means every new cron/worker/web service that needs shared secrets (e.g. PPROTECT_PASSPHRASE, API keys) requires a manual dashboard step. The blueprint envVars section only supports inline value, fromService references, and fromGroup (which references a group name but is not consistently supported across all service types as of mid-2026).
Workaround: minimize the number of Render services that need secrets by consolidating scheduled tasks into fewer dispatcher services (see related lesson on cron consolidation).