diff --git a/05-secrets/openbao/managed/.terraform.lock.hcl b/05-secrets/openbao/managed/.terraform.lock.hcl
index 905a64d..1994e8a 100644
--- a/05-secrets/openbao/managed/.terraform.lock.hcl
+++ b/05-secrets/openbao/managed/.terraform.lock.hcl
@@ -1,29 +1,6 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 
-provider "registry.terraform.io/hashicorp/aws" {
-  version = "6.58.0"
-  hashes = [
-    "h1:OWl47Bo8Vzlf5srTUCmA6v4kvQGfah/P1joRtIYUUMc=",
-    "zh:1221253beee5629fb503d79cebc9bc661279cbc4be5d01db9ab4c1b702108250",
-    "zh:132bd0925bdc4b72446ac750b7ccb1e19b9ba8fbb6df57b2c1423314d2195d4f",
-    "zh:18cda250b9e82b753808715893c8927f132273c00ffae7a697d65ac1cb577e48",
-    "zh:204c944f1fb7f440a335bb2083c9691a9d1f677aea9701025dd5816aee41f0ba",
-    "zh:2dc41df289f2b10a01e650cdd73699955f0ab0645d09cfb114a8cd0f4cc4ede7",
-    "zh:345633dfa9a234659d52aadd126e6dce658518c3ab5cbf6d871221287ed5ec56",
-    "zh:4dadcced73e742903158bc9838936d911f3fa4c2c37b5591c1a28f8f2a1902a6",
-    "zh:5bc60cc2b8c093da98b211d9f6c21c9ecec0f21b944d9ecbe3961fba33086e80",
-    "zh:6cc8f084938b0033a9c0c910989919dad6b1683e76e0afa1a5c604e39f398a75",
-    "zh:7db214647f79de9a033b5dfd6cbfaa42d53c4d056b32cb3acc7ad99306dd548a",
-    "zh:9078589ec881cee7ed9403af262c98ff257fb3e1baae72ff6429a398b1c730af",
-    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:bd5bce6aec4d4922b1127b8575688bd4bc4279670ee28d198ede404709826c7c",
-    "zh:cd900ecf56d21023873898b06e40234f3f4d350f2343b7d9b980d6c5cb604fae",
-    "zh:dbe93b276a84421026b956c3c5b4eb8897da6cbb54b93cb89f5d6ebbd30805ca",
-    "zh:f6b6c7bb2dbf04ee085e5c22f7a65b3ccaebf368ed95584dc0dfee8a22771056",
-  ]
-}
-
 provider "registry.terraform.io/hashicorp/random" {
   version     = "3.9.0"
   constraints = "~> 3.6"
diff --git a/05-secrets/openbao/managed/main.tf b/05-secrets/openbao/managed/main.tf
index 8aa5458..6611f3b 100644
--- a/05-secrets/openbao/managed/main.tf
+++ b/05-secrets/openbao/managed/main.tf
@@ -34,7 +34,16 @@ resource "vault_kubernetes_auth_backend_role" "snapshot" {
 }
 
 # external-secrets/external-secrets — ESO's ClusterSecretStore
-# (gitops repo apps/openbao-init/templates/clustersecretstore.yaml).
+# (gitops repo services/platform/secrets-sync/config/templates/clustersecretstore.yaml).
+# Briefly moved to this root as a kubernetes_manifest resource (2026-08-12),
+# reverted same day: co-locating it with this role was tidier in the
+# abstract, but needed a new `kubernetes` provider on a root that otherwise
+# only talks to Vault, plus a cross-root terraform_remote_state read just
+# for kubeconfig — real added complexity for a problem (GitOps wave
+# ordering looking confusing) that a same-repo move already fixes just as
+# well, with none of that. See the gitops repo commit for the actual fix
+# and its own tradeoff note (secrets-sync isn't a perfectly clean home
+# either — see that file's comment).
 resource "vault_kubernetes_auth_backend_role" "external_secrets" {
   backend                          = vault_auth_backend.kubernetes.path
   role_name                        = "external-secrets"
diff --git a/10-cluster/scaleway/argocd.tf b/10-cluster/scaleway/argocd.tf
index a08a10e..ec6f001 100644
--- a/10-cluster/scaleway/argocd.tf
+++ b/10-cluster/scaleway/argocd.tf
@@ -205,6 +205,18 @@ redis:
       memory: 128Mi
 
 applicationSet:
+  # Beta feature (argo-helm/argo-cd chart): without this flag, the
+  # argocd.argoproj.io/sync-wave annotation on Applications generated by an
+  # ApplicationSet does nothing — each generated Application is created and
+  # auto-synced independently, with no ordering across them. Needed by
+  # gitops's services-app-scaleway ApplicationSet (bootstrap/templates/scaleway.yaml),
+  # whose RollingSync strategy groups Velero/external-dns/Dex/Grafana after
+  # the OpenBao-backed Secrets their own sibling -init/-config apps produce
+  # — confirmed live 2026-08-11 that plain sync-wave annotations alone did
+  # not prevent those pods starting before their credentials existed.
+  extraArgs:
+    - --enable-progressive-syncs
+
   resources:
     requests:
       cpu: 10m