diff --git a/n8n/secret-n8n-secret.yaml b/n8n/secret-n8n-secret.yaml
index 4a7feaa..c5637d9 100644
--- a/n8n/secret-n8n-secret.yaml
+++ b/n8n/secret-n8n-secret.yaml
@@ -4,9 +4,10 @@ metadata:
   name: n8n-secret
   namespace: n8n
   annotations:
-    argocd.argoproj.io/sync-options: "Prune=false"
-    # data managed manually — do NOT store the real value here
-    # create/update with: kubectl create secret generic n8n-secret \
-    #   --from-literal=encryption-key='<value-from-vaultwarden>' \
-    #   -n n8n --dry-run=client -o yaml | kubectl apply -f -
+    # CreateOnly: ArgoCD creates this secret if it doesn't exist but never overwrites it.
+    # Populate the key manually before first deploy:
+    #   kubectl create secret generic n8n-secret \
+    #     --from-literal=encryption-key='<value-from-vaultwarden>' \
+    #     -n n8n --dry-run=client -o yaml | kubectl apply -f -
+    argocd.argoproj.io/sync-options: "CreateOnly=true"
 type: Opaque