diff --git a/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml
index 8c13401..e6634e8 100644
--- a/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml
+++ b/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml
@@ -1,3 +1,9 @@
+# Interim: Forgejo on railiance01 reads SMTP creds from coulombcore OpenBao
+# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7).
+#
+# Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a
+# policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer.
+# Bootstrap: railiance-apps make forgejo-openbao-eso-token-apply
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -8,16 +14,14 @@ metadata:
 spec:
   provider:
     vault:
-      server: http://openbao.openbao.svc.cluster.local:8200
+      server: https://bao.coulomb.social
       path: platform
       version: v2
       auth:
-        kubernetes:
-          mountPath: kubernetes
-          role: external-secrets-forgejo
-          serviceAccountRef:
-            name: external-secrets
-            namespace: external-secrets
+        tokenSecretRef:
+          name: openbao-forgejo-eso-token
+          namespace: external-secrets
+          key: token
   conditions:
     - namespaces:
         - forgejo
\ No newline at end of file