diff --git a/deploy/k8s/railiance/externalsecret.yaml b/deploy/k8s/railiance/externalsecret.yaml
index 935946a..dc2db46 100644
--- a/deploy/k8s/railiance/externalsecret.yaml
+++ b/deploy/k8s/railiance/externalsecret.yaml
@@ -23,6 +23,14 @@ spec:
     kind: ClusterSecretStore
     name: openbao-email-connect
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: email-connect
+          app.kubernetes.io/part-of: email-connect
+        annotations:
+          argocd.argoproj.io/sync-wave: '0'
     name: email-connect-runtime
     creationPolicy: Owner
     deletionPolicy: Retain