diff --git a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
index 7fd3994..5ef5dd8 100644
--- a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
+++ b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
@@ -25,6 +25,20 @@ gitea:
   strategy:
     type: Recreate
 
+  # Scopes Replace=true to ONLY the Deployment (not the whole Application —
+  # see the note in devops-infra-argo-config's values file for why that
+  # broke the PVC). The `configure-gitea` init container's
+  # GITEA_ADMIN_USERNAME/PASSWORD env vars still carry plaintext `value`
+  # fields on the live object from the original imperative install; ours
+  # switch those to `valueFrom: secretKeyRef` (below), and a patch can't
+  # clear the old field while adding the new one. A full PUT of just this
+  # one resource sidesteps that. Safe to remove once the live Deployment
+  # no longer carries the old `value` fields — after that first successful
+  # sync, plain patching is fine again.
+  deployment:
+    annotations:
+      argocd.argoproj.io/sync-options: Replace=true
+
   persistence:
     size: 10Gi
 
@@ -52,12 +66,14 @@ gitea:
         ENABLED: true
     admin:
       username: gitadmin
-      # The running install set this via a plaintext --set-string flag
-      # at install time — the admin account already exists, so switching
-      # to existingSecret here doesn't touch it (Gitea's admin-creation
-      # Job is install-time only, doesn't re-run on upgrade). Still worth
-      # creating this Secret now so a future full reinstall doesn't fail
-      # on a missing values reference:
+      # The running install set this via a plaintext --set-string flag at
+      # install time. Correction from an earlier version of this comment:
+      # this is NOT install-time only — the `configure-gitea` init
+      # container re-runs GITEA_ADMIN_PASSWORD_MODE: keepUpdated on every
+      # pod (re)start, actively syncing the admin password from whatever
+      # this env var resolves to. That's what caused the value->valueFrom
+      # migration conflict fixed above — this Secret must exist and be
+      # correct before the Deployment syncs:
       #   kubectl -n gitea create secret generic gitea-admin-credentials \
       #     --from-literal=username=gitadmin \
       #     --from-literal=password='<the password you already set>'