diff --git a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
index 5ef5dd8..7318bb3 100644
--- a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
+++ b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
@@ -73,10 +73,13 @@ gitea:
       # pod (re)start, actively syncing the admin password from whatever
       # this env var resolves to. That's what caused the value->valueFrom
       # migration conflict fixed above — this Secret must exist and be
-      # correct before the Deployment syncs:
-      #   kubectl -n gitea create secret generic gitea-admin-credentials \
-      #     --from-literal=username=gitadmin \
-      #     --from-literal=password='<the password you already set>'
+      # correct before the Deployment syncs.
+      #
+      # As of the Vault + External Secrets Operator migration, this Secret
+      # is no longer manually kubectl-created — it's managed by the
+      # ExternalSecret at devops-infra-argo-config/secretstores/gitea-admin-credentials.yaml,
+      # sourced from Vault path secret/gitea/admin. Rotate the password via
+      # `vault kv put secret/gitea/admin ...`, not kubectl, from here on.
       existingSecret: gitea-admin-credentials
       email: "admin@local.lab"