Can't change encrypted_regex from CLI

I am trying to add a new secret value to a YAML file and update the encrypted_regex so that this value is encrypted.

Attempt:

$ sops --version
sops 3.7.3 (latest)
$ cat secret.yaml 
password: ENC[AES256_GCM,data:gDkW,iv:NS3yipzHEATLue4hgkgynWy70kBE0VyfIOfIwzO5tX0=,tag:JSy9l30aySFO/nKTEdpbEg==,type:str]
sops:
    kms:
        - arn: arn:aws:kms:[...]
          created_at: "2022-12-06T11:54:38Z"
          enc: AQICAHgPu6n0DgaUaOs+2vLXKG46nRyFxexyCFr+GmAXlP16QQGFsRAlLSYZASnnNHlJdeLyAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMXdmO7cE8kd+wTl9SAgEQgDv+wXle3g/HVtd7W+ENkmnMJtHn0xCOxnZg9lgNsg/G9EBOgTn1c3t8gcJv0NQfc9IOxgHJmjbaECRVVA==
          aws_profile: ""
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2022-12-06T11:54:39Z"
    mac: ENC[AES256_GCM,data:u0g01TmX5ydNNiFJFTsIRyz9314yn18XyXMXuJughQEd0rjgHvGp/MAeqc6Ny1FQ4qe6QH587Vxx/Dz+yCqQrWJ4FC9v6qHJsPRxJxcyjs7oXECe6tqce7R6hOBsz1Psp/ZMnYYLuvWbM2zKyFo58OMJwM6QZqo6K9LYSgHZQMU=,iv:kOAS32B0ZEk+moNibLnDmCa5bKZFRX3B5Lct/nRPrd4=,tag:ozKxdscoJA0Ldt8SPh35Mw==,type:str]
    pgp: []
    encrypted_regex: password
    version: 3.7.3
$ sops --in-place --encrypted-regex 'password|secret' secret.yaml  # added `secret: bar` as the second line 
$ cat secret.yaml 
password: ENC[AES256_GCM,data:gDkW,iv:NS3yipzHEATLue4hgkgynWy70kBE0VyfIOfIwzO5tX0=,tag:JSy9l30aySFO/nKTEdpbEg==,type:str]
secret: bar
sops:
    kms:
        - arn: arn:aws:kms:[...]
          created_at: "2022-12-06T11:54:38Z"
          enc: AQICAHgPu6n0DgaUaOs+2vLXKG46nRyFxexyCFr+GmAXlP16QQGFsRAlLSYZASnnNHlJdeLyAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMXdmO7cE8kd+wTl9SAgEQgDv+wXle3g/HVtd7W+ENkmnMJtHn0xCOxnZg9lgNsg/G9EBOgTn1c3t8gcJv0NQfc9IOxgHJmjbaECRVVA==
          aws_profile: ""
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2022-12-06T11:55:33Z"
    mac: ENC[AES256_GCM,data:bL6JI2Dx7/W2AMzexis+nIMDU5GD3nV35lOZ2zaCX/+HyzIw+LPJ27I1JdMtuCEiX7MvX0Fk9HGrwBLxJvDiiP5JIHviWaOMUbWTqnbfeOo1e+6ZsQr1sFgWP2MLySQZRTj9jJUr/CJe68fZAD+vLYfEiQ7tOaMmt+o/eWap77M=,iv:pi/ZYWe8SB5QPqstDAI+olJkxhVZGwWMXx/gBSII6NY=,tag:ZD7QURzgU3PWhvGA2D+HKw==,type:str]
    pgp: []
    encrypted_regex: password
    version: 3.7.3
$

I expected bar to be encrypted and encrypted_regex to be changed to password|secret in the YAML file, but neither of those have happened.

Start at the CLI handling for --encrypted-regex and the YAML metadata update path, then reproduce the command from the issue with the provided secret.yaml shape. Done means the new secret value is encrypted and the stored encrypted_regex changes from password to password|secret, with the existing encrypted value preserved.