diff --git a/deploy/k8s/activity-core-llm-connect/externalsecret.yaml b/deploy/k8s/activity-core-llm-connect/externalsecret.yaml
index ff0738c..aaea5e9 100644
--- a/deploy/k8s/activity-core-llm-connect/externalsecret.yaml
+++ b/deploy/k8s/activity-core-llm-connect/externalsecret.yaml
@@ -12,6 +12,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-activity-core
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: llm-connect
+          app.kubernetes.io/part-of: railiance-gitops
     name: llm-connect-provider-secrets
     creationPolicy: Owner
   data: