diff --git a/k8s/README.md b/k8s/README.md
index e27d7ab4..11b17911 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -2,20 +2,15 @@
 
 ## Secrets Management
 
-Secrets are stored in `.envrc` files (gitignored):
-- Project root `.envrc` - Used by direnv for local development
-- `k8s/.envrc` - Used by Kustomize for secret generation
+Secrets are managed directly in the cluster and must be created before deploying the application.
 
-Kustomize automatically generates the `towerops-sendgrid` Secret from `k8s/.envrc` using the `secretGenerator` in `kustomization.yaml`.
+Required secrets in the `towerops` namespace:
+- `gitlab-registry` - Docker registry credentials for pulling images
+- `towerops-secrets` - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE)
+- `towerops-db` - Database connection credentials
+- `towerops-aws` - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION)
 
-Both `.envrc` files should contain:
-```bash
-# SendGrid Configuration
-SENDGRID_API_KEY=your-api-key-here
-export SENDGRID_API_KEY
-```
-
-The KEY=VALUE format works for both Kustomize and direnv.
+For local development, the project root `.envrc` is used by direnv.
 
 ## Deploying
 
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index e9366275..37dff34c 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -8,10 +8,3 @@ resources:
   - service-headless.yaml
   - certificate.yaml
   - ingressroute.yaml
-
-secretGenerator:
-  - name: towerops-aws
-    envs:
-      - .envrc
-    options:
-      disableNameSuffixHash: true