diff --git a/zona-exclusion/deployment.yaml b/zona-exclusion/deployment.yaml
index 663c9c9..c232458 100644
--- a/zona-exclusion/deployment.yaml
+++ b/zona-exclusion/deployment.yaml
@@ -121,18 +121,8 @@ spec:
         - zonadeexclusion.com
       secretName: zona-exclusion-tls
 
----
-# Secret template — fill with real values and apply manually
+# Secret gestionado manualmente — NO añadir aquí para evitar que ArgoCD sobreescriba.
 # kubectl create secret generic zona-exclusion-secrets \
 #   --from-literal=smtp-user=chemavx@gmail.com \
 #   --from-literal=smtp-pass=YOUR_APP_PASSWORD \
 #   -n zona-exclusion
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zona-exclusion-secrets
-  namespace: zona-exclusion
-type: Opaque
-stringData:
-  smtp-user: "REPLACE_ME"
-  smtp-pass: "REPLACE_ME"