diff --git a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
index 33f778f..b21916d 100644
--- a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
+++ b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
@@ -73,12 +73,16 @@ appSpec:
     chartDir: contour
     valuesDir: contour
   - name: external-secrets
-    # Fresh install, no existing release to adopt — no nameOverride
-    # needed. Replaces the Vault Agent Injector for pulling secrets into
-    # pods. This just brings the controller up; wiring a
-    # SecretStore/ClusterSecretStore to Vault as the actual backend is a
-    # separate step once this is healthy (needs a Kubernetes auth method
-    # enabled on the Vault side first).
+    # Correction from an earlier version of this file: "no nameOverride
+    # needed" was wrong. Without one, the Application (and therefore the
+    # Helm release name the chart templates with) becomes
+    # "external-secrets-admin-prd" — so the controller's ServiceAccount
+    # actually ends up named external-secrets-admin-prd, not
+    # external-secrets. secretstores/vault-backend.yaml's
+    # serviceAccountRef assumes the plain name, and Vault's role was bound
+    # to bound_service_account_names=external-secrets — both need this
+    # pinned name to match.
+    nameOverride: external-secrets
     namespace: external-secrets
     chartDir: external-secrets
     valuesDir: external-secrets