diff --git a/deploy/railiance/manifests.yaml b/deploy/railiance/manifests.yaml
index a15797d..3c31c69 100644
--- a/deploy/railiance/manifests.yaml
+++ b/deploy/railiance/manifests.yaml
@@ -48,7 +48,14 @@ metadata: {name: mas-relay, namespace: mas}
 spec:
   refreshInterval: 1h
   secretStoreRef: {name: openbao-mas-tem-relay, kind: SecretStore}
-  target: {name: mas-relay, creationPolicy: Owner}
+  target:
+    name: mas-relay
+    creationPolicy: Owner
+    # Explicit target metadata stops ESO copying the last-applied annotation,
+    # which policy reject-secret-last-applied forbids on Secrets.
+    template:
+      metadata:
+        labels: {app.kubernetes.io/name: mas-mx}
   data:
     - {secretKey: username, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: username}}
     - {secretKey: password, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: password}}