diff --git a/resources/org/homelab/dind-pod.yaml b/resources/org/homelab/dind-pod.yaml
index f6a3d33..38d643c 100644
--- a/resources/org/homelab/dind-pod.yaml
+++ b/resources/org/homelab/dind-pod.yaml
@@ -72,3 +72,18 @@ spec:
     - name: docker-config
       secret:
         secretName: harbor-robot-dockerconfig
+        # kubernetes.io/dockerconfigjson secrets store their data under
+        # the fixed key `.dockerconfigjson` (mandated, since that's what
+        # kubelet reads for imagePullSecrets) — without this remap, the
+        # mounted file at /root/.docker is literally named
+        # `.dockerconfigjson`, not `config.json`, which is the only
+        # filename the docker CLI itself ever reads for stored
+        # credentials. Docker found nothing there and silently pushed
+        # unauthenticated, which Harbor correctly rejected as
+        # unauthorized — confirmed the robot account/credentials
+        # themselves were fine the whole time by requesting a push token
+        # directly from Harbor's token endpoint with the same username/
+        # password and getting one back with push access granted.
+        items:
+          - key: .dockerconfigjson
+            path: config.json