diff --git a/secretstores/toolshed-harbor-cleanup.yaml b/secretstores/toolshed-harbor-cleanup.yaml
new file mode 100644
index 0000000..ca69708
--- /dev/null
+++ b/secretstores/toolshed-harbor-cleanup.yaml
@@ -0,0 +1,49 @@
+# Harbor management-API credentials for toolshed's builder, used only to
+# delete a repository (every tagged image an app's builds ever pushed) when
+# the app itself is deleted.
+#
+# Deliberately a separate robot account from harbor-robot-dockerconfig
+# (secretstores/harbor-robot-dockerconfig.yaml), not a reuse of it. That one
+# is mounted into build pods, which run arbitrary user-supplied Dockerfiles —
+# scoped to push+pull only. This one is held by builder itself, a trusted
+# platform service that never executes user code directly, and needs a
+# permission the other should never carry: delete. Keeping them on separate
+# credentials means a leaked build-pod credential can never delete anything,
+# and a leaked cleanup credential can never push.
+#
+# Create the robot in Harbor's UI: homelab project -> Robot Accounts ->
+# New Robot Account. Scope it to that one project, permission "Delete
+# repository" (and "Delete artifact") only — leave push/pull unchecked, it
+# never needs them. Harbor shows the generated secret exactly once.
+#
+#   kubectl -n vault exec -i vault-0 -- sh -lc '
+#     vault login <root-token> >/dev/null &&
+#     vault kv put secret/harbor/toolshed-cleanup \
+#       username="robot\$homelab+toolshed-cleanup" \
+#       password="<the generated secret>"'
+#
+# Until this exists, builder logs "no management credentials, leaving its
+# image alone" for every app deletion and does nothing destructive — see
+# internal/builder/builder.go's cleanupImage in the toolshed repo.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: toolshed-harbor-cleanup
+  namespace: toolshed
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: toolshed-harbor-cleanup
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: harbor/toolshed-cleanup
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: harbor/toolshed-cleanup
+        property: password