diff --git a/k8s/railiance/15-externalsecret-backup-offsite.yaml b/k8s/railiance/15-externalsecret-backup-offsite.yaml
index 5a30c89..55c3b0f 100644
--- a/k8s/railiance/15-externalsecret-backup-offsite.yaml
+++ b/k8s/railiance/15-externalsecret-backup-offsite.yaml
@@ -28,6 +28,14 @@ spec:
     kind: ClusterSecretStore
     name: openbao-activity-core
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: activity-core
+          app.kubernetes.io/part-of: activity-core
+        annotations:
+          argocd.argoproj.io/sync-wave: '0'
     name: actcore-runtime-secret
     creationPolicy: Merge
     deletionPolicy: Retain
diff --git a/k8s/railiance/15-externalsecret-forgejo-admin.yaml b/k8s/railiance/15-externalsecret-forgejo-admin.yaml
index 0961f51..04e231a 100644
--- a/k8s/railiance/15-externalsecret-forgejo-admin.yaml
+++ b/k8s/railiance/15-externalsecret-forgejo-admin.yaml
@@ -30,6 +30,14 @@ spec:
     kind: ClusterSecretStore
     name: openbao-activity-core
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: activity-core
+          app.kubernetes.io/part-of: activity-core
+        annotations:
+          argocd.argoproj.io/sync-wave: '0'
     name: actcore-runtime-secret
     creationPolicy: Merge
     deletionPolicy: Retain
diff --git a/k8s/railiance/15-externalsecret-issue-core.yaml b/k8s/railiance/15-externalsecret-issue-core.yaml
index 8ca132d..a55ecd5 100644
--- a/k8s/railiance/15-externalsecret-issue-core.yaml
+++ b/k8s/railiance/15-externalsecret-issue-core.yaml
@@ -26,6 +26,14 @@ spec:
     kind: ClusterSecretStore
     name: openbao-activity-core
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: activity-core
+          app.kubernetes.io/part-of: activity-core
+        annotations:
+          argocd.argoproj.io/sync-wave: '0'
     name: actcore-runtime-secret
     creationPolicy: Merge
     deletionPolicy: Retain
diff --git a/k8s/railiance/15-externalsecret-worker-tokens.yaml b/k8s/railiance/15-externalsecret-worker-tokens.yaml
index 47d3643..c210190 100644
--- a/k8s/railiance/15-externalsecret-worker-tokens.yaml
+++ b/k8s/railiance/15-externalsecret-worker-tokens.yaml
@@ -30,6 +30,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-activity-core
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: activity-core
+          app.kubernetes.io/part-of: activity-core
     name: actcore-runtime-secret
     creationPolicy: Merge
     deletionPolicy: Retain