diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age
index 0fc51a2..aa5a657 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age
index 6d0a7a4..207fcfa 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age
index 7a5c0cf..5a879e2 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age and b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age
index 12d17a8..b4096a6 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age and b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
index 190a7d4..7c980aa 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age
index dc2e160..8d0b489 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age
index 515c59e..b5da637 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age
index 11f4e30..1c1d45d 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age
index 3240ba4..2368f66 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age
index bfbc853..1bddc25 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age
index 884aec6..b8486ae 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ
diff --git a/sso-mfa/k8s/identity-provisioner/bind-eso.yaml b/sso-mfa/k8s/identity-provisioner/bind-eso.yaml
index b5724cb..b085745 100644
--- a/sso-mfa/k8s/identity-provisioner/bind-eso.yaml
+++ b/sso-mfa/k8s/identity-provisioner/bind-eso.yaml
@@ -42,6 +42,10 @@ spec:
     kind: SecretStore
     name: net-kingdom-svc-provisioner-bind
   target:
+    # Explicit target metadata stops ESO copying this object's kubectl
+    # last-applied annotation onto the Secret (refused by reject-secret-last-applied).
+    template:
+      metadata: {}
     name: identity-provisioner-ldap
     creationPolicy: Merge
     deletionPolicy: Retain
diff --git a/tests/test_service_bind_lane.py b/tests/test_service_bind_lane.py
index 1a79264..97a325e 100644
--- a/tests/test_service_bind_lane.py
+++ b/tests/test_service_bind_lane.py
@@ -175,7 +175,8 @@ def test_manifest_matches_contract():
     sa, store, es = docs
     assert sa['metadata'] == {'name': 'net-kingdom-svc-provisioner-bind-eso', 'namespace': 'sso'}
     assert store['spec']['provider']['vault']['auth']['kubernetes']['role'] == 'net-kingdom-svc-provisioner-bind-eso'
-    assert es['spec']['target'] == {'name': 'identity-provisioner-ldap', 'creationPolicy': 'Merge', 'deletionPolicy': 'Retain'}
+    assert es['spec']['target'] == {'template': {'metadata': {}}, 'name': 'identity-provisioner-ldap',
+                                    'creationPolicy': 'Merge', 'deletionPolicy': 'Retain'}
     assert es['spec']['data'] == [{'secretKey': 'password', 'remoteRef': {
         'key': 'workloads/net-kingdom/directory-binds/svc-provisioner', 'property': 'LDAP_BIND_PASSWORD'}}]