updatekeys uses .sops.yaml closest to PWD while --encrypt uses closest to project root

I have observed the following for v 3.6.1:

Given the following directory structure:

.
├── README.md
├── deploy
│   ├── README.md
│   ├── flux
│   │   ├── .sops.yaml
│   │   ├── base
│   │   │   ├── ...
│   │   │   ├── kustomization.yaml
│   │   │   └── namespace.yaml
│   │   └── overlays
│   │       └── dev
│   │           ├── ...
│   │           ├── .sops.yaml
│   │           ├── kustomization.yaml
│   │           ├── kustomizeconfig.yaml
│   │           ├── secrets
│   │           │   ├── ...
│   │           │   ├── deploy
│   │           │   │   └── my-secret.yaml
│   │           └── values
│   │               └── ...
│   └── scripts
│       └── ...
└── docs
    └── ...

With the following contents for ./deploy/flux/.sops.yaml (referred to as SOPS1 going forward):

creation_rules:
  - encrypted_regex: '^(data|stringData)$'
    pgp: <FP11>

and the following contents for ./deploy/flux/overlays/dev/.sops.yaml (referred to as SOPS2 going forward):

creation_rules:
  - encrypted_regex: '^(data|stringData)$'
    pgp: >-
      <FP1>,
      <FP2>,
      <FP3>

where <FP1> / <FP2> / <FP3> actually contain valid PGP fingerprints.

Behavior:

1. Run at or below ./deploy/flux/overlays/dev:

   # from dev dir
   sops --encrypt --in-place secrets/deploy/my-secret.yaml
   

   Encrypts with the keys specified in SOPS1.

   # from dev dir
   sops updatekeys secrets/deploy/my-secret.yaml
   

   Encrypts with the keys specified in SOPS2.

2. Run at or below ./deploy/flux but above ./deploy/flux/overlays/dev:

   # from flux dir
   sops --encrypt --in-place overlays/dev/secrets/deploy/my-secret.yaml
   

   Encrypts with the keys specified in SOPS1.

   # from flux dir
   sops updatekeys overlays/dev/secrets/deploy/my-secret.yaml
   

   Encrypts with the keys specified in SOPS1.

Expected behavior:

1. Run at or below ./deploy/flux/overlays/dev:
   sops --encrypt would encrypt with the keys specified in SOPS2.
   sops updatekeys would re-encrypt with the keys specified in SOPS2.

2. Run at or below ./deploy/flux but above ./deploy/flux/overlays/dev:
   sops --encrypt would encrypt with the keys specified in SOPS1.
   sops updatekeys would encrypt with the keys specified in SOPS1.

Reproduce the two command pairs from the issue using the shown nested .sops.yaml files and paths. Compare the configuration lookup paths used by --encrypt and updatekeys, then verify that both commands select the nearest applicable configuration from either working directory; the differing key selection should be resolved.