diff --git a/manifests/reuse-surface-runtime-externalsecret.yaml b/manifests/reuse-surface-runtime-externalsecret.yaml
index 6239f45..3822799 100644
--- a/manifests/reuse-surface-runtime-externalsecret.yaml
+++ b/manifests/reuse-surface-runtime-externalsecret.yaml
@@ -1,3 +1,4 @@
+# PROPOSAL ONLY: phase B, after hardened runtime verified and CCR approved.
 # reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
 #
 # OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
@@ -38,4 +39,8 @@ spec:
     - secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
       remoteRef:
         key: workloads/reuse/reuse-surface/runtime-secrets
-        property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
\ No newline at end of file
+        property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+    - secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN
+      remoteRef:
+        key: workloads/reuse/reuse-surface/forgejo-source-read
+        property: FORGEJO_SOURCE_TOKEN