diff --git a/kubernetes/apps/matrix/bridge.yaml b/kubernetes/apps/matrix/bridge.yaml
index 58bada95..b8e763a9 100644
--- a/kubernetes/apps/matrix/bridge.yaml
+++ b/kubernetes/apps/matrix/bridge.yaml
@@ -6,32 +6,47 @@
 # No volume: the bridge keeps its state in the bot's account data on Synapse.
 # No ingress: only Synapse talks to it (appservice transactions on :8080).
 #
-# OpenBao homelab/apps/matrix-bridge (seeded by the owner):
-#   as_token           random; bridge -> Synapse, MATRIX_AS_TOKEN
-#   hs_token           random; Synapse -> bridge, MATRIX_HS_TOKEN
-#   paperclip_api_key  Paperclip board key "matrix-bridge (board)" (REN-582)
-#
-# The same Secret carries the appservice registration that Synapse loads
-# from app_service_config_files (synapse.yaml), so both sides always get the
-# same tokens. Synapse cannot start without it: seed OpenBao before merge.
+# Secrets:
+#   matrix-bridge-tokens  as_token (bridge -> Synapse) and hs_token (Synapse
+#                         -> bridge), generated once in-cluster by ESO, plus
+#                         the appservice registration Synapse loads from
+#                         app_service_config_files (synapse.yaml). Both sides
+#                         read the same Secret, so the tokens cannot drift.
+#                         Deleting the Secret regenerates both; Reloader
+#                         restarts Synapse and the bridge.
+#   matrix-bridge         paperclip_api_key from OpenBao
+#                         homelab/apps/matrix-bridge: the Paperclip board key
+#                         "matrix-bridge (board)" (REN-582).
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: matrix-bridge-tokens
+  namespace: matrix
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - as_token
+    - hs_token
+---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-bridge
+  name: matrix-bridge-tokens
   namespace: matrix
 spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
+  # Generate once; Periodic would rotate the tokens every refresh.
+  refreshPolicy: CreatedOnce
   target:
-    name: matrix-bridge
+    name: matrix-bridge-tokens
     template:
       engineVersion: v2
       data:
         as_token: "{{ .as_token }}"
         hs_token: "{{ .hs_token }}"
-        paperclip_api_key: "{{ .paperclip_api_key }}"
         # Agent users are @agent_<urlKey>:matrix.renner.uno; the bot is
         # @paperclip:matrix.renner.uno.
         registration.yaml: |
@@ -48,8 +63,29 @@ spec:
             aliases: []
             rooms: []
   dataFrom:
-    - extract:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: matrix-bridge-tokens
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: matrix-bridge
+  namespace: matrix
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: matrix-bridge
+  data:
+    - secretKey: paperclip_api_key
+      remoteRef:
         key: apps/matrix-bridge
+        property: paperclip_api_key
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -57,7 +93,7 @@ metadata:
   name: matrix-bridge
   namespace: matrix
   annotations:
-    secret.reloader.stakater.com/reload: matrix-bridge
+    secret.reloader.stakater.com/reload: matrix-bridge,matrix-bridge-tokens
   labels:
     app.kubernetes.io/name: matrix-bridge
     app.kubernetes.io/part-of: matrix
@@ -101,12 +137,12 @@ spec:
             - name: MATRIX_AS_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: matrix-bridge
+                  name: matrix-bridge-tokens
                   key: as_token
             - name: MATRIX_HS_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: matrix-bridge
+                  name: matrix-bridge-tokens
                   key: hs_token
             - name: PAPERCLIP_API_URL
               value: http://paperclip.paperclip.svc.cluster.local:3100
diff --git a/kubernetes/apps/matrix/synapse.yaml b/kubernetes/apps/matrix/synapse.yaml
index ada370ad..27c6fce8 100644
--- a/kubernetes/apps/matrix/synapse.yaml
+++ b/kubernetes/apps/matrix/synapse.yaml
@@ -120,7 +120,7 @@ metadata:
   namespace: matrix
   annotations:
     configmap.reloader.stakater.com/reload: synapse-config,mas-config
-    secret.reloader.stakater.com/reload: synapse-secrets,matrix-bridge
+    secret.reloader.stakater.com/reload: synapse-secrets,matrix-bridge-tokens
   labels:
     app.kubernetes.io/name: synapse
     app.kubernetes.io/part-of: matrix
@@ -305,7 +305,7 @@ spec:
           emptyDir: {}
         - name: appservice-matrix-bridge
           secret:
-            secretName: matrix-bridge
+            secretName: matrix-bridge-tokens
             items:
               - key: registration.yaml
                 path: registration.yaml