diff --git a/manifests/forgejo-mailer-externalsecret.yaml b/manifests/forgejo-mailer-externalsecret.yaml
index 4585bc1..9d00922 100644
--- a/manifests/forgejo-mailer-externalsecret.yaml
+++ b/manifests/forgejo-mailer-externalsecret.yaml
@@ -21,6 +21,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-forgejo
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: forgejo
+          app.kubernetes.io/part-of: railiance-apps
     name: forgejo-mailer
     creationPolicy: Owner
   data:
diff --git a/manifests/reuse-surface-runtime-externalsecret.yaml b/manifests/reuse-surface-runtime-externalsecret.yaml
index ece02cb..6239f45 100644
--- a/manifests/reuse-surface-runtime-externalsecret.yaml
+++ b/manifests/reuse-surface-runtime-externalsecret.yaml
@@ -22,6 +22,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-reuse
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: reuse-surface
+          app.kubernetes.io/part-of: railiance-apps
     name: reuse-surface-env
     creationPolicy: Owner
   data: