diff --git a/kubernetes/apps/shelly-manager/registry-secret.sops.yaml b/kubernetes/apps/shelly-manager/registry-secret.sops.yaml
index 137596a8..f6be0bdc 100644
--- a/kubernetes/apps/shelly-manager/registry-secret.sops.yaml
+++ b/kubernetes/apps/shelly-manager/registry-secret.sops.yaml
@@ -1,8 +1,12 @@
-# PLACEHOLDER — must be SOPS-encrypted before flux reconciles it.
-# Steps to populate:
-#   1. Mint a gitea token for user `k.renner` with packages:read scope at
+# PLACEHOLDER — must be SOPS-encrypted with real credentials before
+# the Deployment can pull. The empty-auths value below is valid base64
+# so the Secret applies cleanly (Flux stays healthy) but won't grant
+# any pulls until replaced — the resulting pod ImagePullBackOff is the
+# signal to populate real creds.
+# Steps:
+#   1. Mint a gitea token for user `k.renner` with packages:read at
 #      https://gitea.renner.uno/user/settings/applications
-#   2. Replace REPLACE_WITH_BASE64_DOCKERCONFIG below with:
+#   2. Replace `.dockerconfigjson` below with the real base64:
 #        printf '{"auths":{"gitea.renner.uno":{"username":"k.renner","password":"<token>","auth":"<b64 k.renner:token>"}}}' | base64 -w0
 #   3. sops -e -i kubernetes/apps/shelly-manager/registry-secret.sops.yaml
 apiVersion: v1
@@ -12,4 +16,5 @@ metadata:
   namespace: apps
 type: kubernetes.io/dockerconfigjson
 data:
-  .dockerconfigjson: REPLACE_WITH_BASE64_DOCKERCONFIG
+  # base64 of `{"auths":{}}` — placeholder, replace before pushing.
+  .dockerconfigjson: eyJhdXRocyI6e319
diff --git a/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml b/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml
index dc1447e8..be99227a 100644
--- a/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml
+++ b/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml
@@ -1,10 +1,13 @@
-# PLACEHOLDER — must be SOPS-encrypted before flux reconciles it.
+# PLACEHOLDER — must be SOPS-encrypted with real credentials before
+# image-reflector can list tags. The empty-auths value below is valid
+# base64 so the Secret applies cleanly (infrastructure stays healthy)
+# but won't grant any registry access until replaced.
 # Same token as kubernetes/apps/shelly-manager/registry-secret.sops.yaml,
 # but in the flux-system namespace so image-reflector-controller can
 # list tags on the private gitea registry.
 # Steps:
 #   1. Use the same gitea token you minted for the apps-ns secret.
-#   2. Replace REPLACE_WITH_BASE64_DOCKERCONFIG with:
+#   2. Replace `.dockerconfigjson` below with the real base64:
 #        printf '{"auths":{"gitea.renner.uno":{"username":"k.renner","password":"<token>","auth":"<b64 k.renner:token>"}}}' | base64 -w0
 #   3. sops -e -i kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml
 apiVersion: v1
@@ -14,4 +17,5 @@ metadata:
   namespace: flux-system
 type: kubernetes.io/dockerconfigjson
 data:
-  .dockerconfigjson: REPLACE_WITH_BASE64_DOCKERCONFIG
+  # base64 of `{"auths":{}}` — placeholder, replace before pushing.
+  .dockerconfigjson: eyJhdXRocyI6e319