diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 19b3c375..c98327c6 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -1,8 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+# secret.yaml is applied out-of-band and is git-ignored (contains plaintext
+# credentials). Flux reconciles deployment.yaml etc. but does NOT manage the
+# secret. Rotate secrets by applying secret.yaml with kubectl directly.
 resources:
   - namespace.yaml
-  - secret.yaml
   - rbac.yaml
   - deployment.yaml
   - service.yaml