diff --git a/argocd/application-infisical-config.yaml b/argocd/application-infisical-config.yaml
new file mode 100644
index 0000000..9749bfa
--- /dev/null
+++ b/argocd/application-infisical-config.yaml
@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: infisical-config
+  namespace: argocd
+spec:
+  destination:
+    namespace: infisical-operator
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: infisical-config
+    repoURL: https://git.chemavx.xyz/chemavx/k8s-manifests
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/infisical-config/infisicalauth.yaml b/infisical-config/infisicalauth.yaml
new file mode 100644
index 0000000..689a516
--- /dev/null
+++ b/infisical-config/infisicalauth.yaml
@@ -0,0 +1,18 @@
+apiVersion: secrets.infisical.com/v1beta1
+kind: InfisicalAuth
+metadata:
+  name: infisical-auth
+  namespace: infisical-operator
+spec:
+  infisicalConnectionRef:
+    name: infisical-connection
+    namespace: infisical-operator
+  method: kubernetes
+  kubernetes:
+    identityIdRef:
+      name: infisical-machine-identity
+      namespace: infisical-operator
+      key: identityId
+    serviceAccountRef:
+      name: infisical-opera-controller-manager   # operator's own SA = the allow-listed identity
+      namespace: infisical-operator
diff --git a/infisical-config/infisicalconnection.yaml b/infisical-config/infisicalconnection.yaml
new file mode 100644
index 0000000..20355df
--- /dev/null
+++ b/infisical-config/infisicalconnection.yaml
@@ -0,0 +1,7 @@
+apiVersion: secrets.infisical.com/v1beta1
+kind: InfisicalConnection
+metadata:
+  name: infisical-connection
+  namespace: infisical-operator
+spec:
+  address: https://infisical.chemavx.xyz   # bare host, no /api (operator appends it)
diff --git a/infisical-config/secret-machine-identity.yaml b/infisical-config/secret-machine-identity.yaml
new file mode 100644
index 0000000..8df68b7
--- /dev/null
+++ b/infisical-config/secret-machine-identity.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: infisical-machine-identity
+  namespace: infisical-operator
+type: Opaque
+stringData:
+  # Non-secret UUID for machine identity "k8s-operator". Required as a secretRef
+  # by the InfisicalAuth schema; auth happens via the operator's SA token (TokenReview),
+  # so this value grants nothing on its own. Safe to commit.
+  identityId: "42c12566-1058-4674-a5f5-0cc1bc0ea4e7"