diff --git a/secretstores/demo-go-app-image-pull-secret.yaml b/secretstores/demo-go-app-image-pull-secret.yaml
deleted file mode 100644
index 867e58b..0000000
--- a/secretstores/demo-go-app-image-pull-secret.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# imagePullSecret for demo-go-app's own Deployment — separate from
-# harbor-robot-dockerconfig (which lives in the jenkins namespace, for
-# the build pod's docker push). This one lands in the demo-go-app
-# namespace itself, since imagePullSecrets must be in the same namespace
-# as the pod referencing them. Same underlying robot account/Vault path
-# (harbor/jenkins-robot already has push+pull scope), just synced to a
-# second namespace and keyed to the same Contour ingress hostname used
-# for the image reference in values/demo-go-app/demo-go-app/values.yaml.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: demo-go-app-image-pull-secret
-  namespace: demo-go-app
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  target:
-    name: demo-go-app-image-pull-secret
-    creationPolicy: Owner
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: |
-          {"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
-  data:
-    - secretKey: username
-      remoteRef:
-        key: harbor/jenkins-robot
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: harbor/jenkins-robot
-        property: password