diff --git a/deploy/chart/values.yaml b/deploy/chart/values.yaml
index 332f86a..9b5e140 100644
--- a/deploy/chart/values.yaml
+++ b/deploy/chart/values.yaml
@@ -81,9 +81,30 @@ otel:
 log:
   level: info
 # The DSNs are pulled from Vault by external-secrets into a Secret the pods envFrom.
-# No DSN is ever a chart value, a ConfigMap key, or a CI variable.
+# No DSN is ever a chart value, a ConfigMap key, or a CI variable. That invariant holds
+# either way here — what changes below is only who creates the Secret.
+#
+# DISABLED ON THIS CLUSTER, AND THIS IS A DEVIATION, NOT THE DESIGN.
+#
+# The block below describes a ClusterSecretStore named `vault` with HashiCorp-style
+# key/property refs. This cluster has `oci-vault` instead: OCI Vault via InstancePrincipal,
+# whose provider addresses a secret by NAME and takes a JSON property, so these remoteRefs
+# do not translate as written. There are also no ExternalSecrets anywhere on the cluster
+# yet, so nothing has ever exercised this path.
+#
+# With this false, `svcforge.secretName` still resolves through targetName, so the
+# deployments and the migrate hook read a Secret called `svcforge-secrets` that was created
+# out of band:
+#
+#   kubectl -n svcforge create secret generic svcforge-secrets \
+#     --from-env-file=~/.config/svcforge/secrets.env
+#
+# ArgoCD does not manage that Secret, so prune and selfHeal cannot touch it — which is also
+# why it is invisible in git, and the one part of this deployment you cannot read from the
+# repo. Restoring the intended design means adding oci_vault_secret resources to
+# oci-k8s/infra/vault.tf and repointing secretStoreRef at oci-vault.
 externalSecret:
-  enabled: true
+  enabled: false
   secretStoreRef:
     name: vault
     kind: ClusterSecretStore