I am assuming that I am just doing something Wrong™️, but I don't know what. Does anyone have any pointers?

Do you have a minimal example that you can share? This sounds like Pulumi does not correctly detect that input/output values do not change.

I agree that its mostly likely something off about the values. But I had this problem when I created a secret with no values - though that's a slightly odd thing to do (I was bootstrapping a project, I know there will be secrets and the code I copied already had a secret set up so... 🤷🏻).

I will try and recreate in a smaller example 🙂