diff --git a/kubernetes/apps/authentik/barman-creds-externalsecret.yaml b/kubernetes/apps/authentik/barman-creds-externalsecret.yaml
index 97c52809..40a1877c 100644
--- a/kubernetes/apps/authentik/barman-creds-externalsecret.yaml
+++ b/kubernetes/apps/authentik/barman-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: barman-cloud-creds
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (barman creds).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (barman creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/authentik/hetzner-creds-externalsecret.yaml b/kubernetes/apps/authentik/hetzner-creds-externalsecret.yaml
index 6c9e89b4..256aa150 100644
--- a/kubernetes/apps/authentik/hetzner-creds-externalsecret.yaml
+++ b/kubernetes/apps/authentik/hetzner-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/authentik/objectstore.yaml b/kubernetes/apps/authentik/objectstore.yaml
index cea8b8bf..4510c52a 100644
--- a/kubernetes/apps/authentik/objectstore.yaml
+++ b/kubernetes/apps/authentik/objectstore.yaml
@@ -5,7 +5,7 @@ metadata:
   name: ak-pg-store
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:
diff --git a/kubernetes/apps/authentik/scheduled-backup.yaml b/kubernetes/apps/authentik/scheduled-backup.yaml
index 62668d70..23d36e6b 100644
--- a/kubernetes/apps/authentik/scheduled-backup.yaml
+++ b/kubernetes/apps/authentik/scheduled-backup.yaml
@@ -11,7 +11,7 @@ metadata:
   name: ak-pg-daily
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 30 2 * * *"
diff --git a/kubernetes/apps/immich/barman-creds-externalsecret.yaml b/kubernetes/apps/immich/barman-creds-externalsecret.yaml
index 1a626ec8..bc17618e 100644
--- a/kubernetes/apps/immich/barman-creds-externalsecret.yaml
+++ b/kubernetes/apps/immich/barman-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: barman-cloud-creds
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (barman creds).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (barman creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/immich/hetzner-creds-externalsecret.yaml b/kubernetes/apps/immich/hetzner-creds-externalsecret.yaml
index 1557f0cb..ccb23e84 100644
--- a/kubernetes/apps/immich/hetzner-creds-externalsecret.yaml
+++ b/kubernetes/apps/immich/hetzner-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/immich/objectstore.yaml b/kubernetes/apps/immich/objectstore.yaml
index 949a5d12..1e66103a 100644
--- a/kubernetes/apps/immich/objectstore.yaml
+++ b/kubernetes/apps/immich/objectstore.yaml
@@ -5,7 +5,7 @@ metadata:
   name: im-pg-store
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:
diff --git a/kubernetes/apps/immich/scheduled-backup.yaml b/kubernetes/apps/immich/scheduled-backup.yaml
index ec820aad..c2817a66 100644
--- a/kubernetes/apps/immich/scheduled-backup.yaml
+++ b/kubernetes/apps/immich/scheduled-backup.yaml
@@ -7,7 +7,7 @@ metadata:
   name: im-pg-daily
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 0 3 * * *"
diff --git a/kubernetes/apps/influxdb/externalsecret.yaml b/kubernetes/apps/influxdb/externalsecret.yaml
index 4cff7948..da4b58fd 100644
--- a/kubernetes/apps/influxdb/externalsecret.yaml
+++ b/kubernetes/apps/influxdb/externalsecret.yaml
@@ -4,8 +4,8 @@ metadata:
   name: influxdb-bootstrap
   namespace: influxdb
   annotations:
-    # Prune-disabled ahead of the seed->apps handoff so the bootstrap Secret
-    # (admin token) can't be deleted out from under the token Jobs mid-move.
+    # Prune-disabled — a standing guard on the bootstrap Secret (admin token);
+    # kept from the seed->apps move so ESO/the token Jobs always have it.
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/paperless/barman-creds-externalsecret.yaml b/kubernetes/apps/paperless/barman-creds-externalsecret.yaml
index bffb0d43..e2758342 100644
--- a/kubernetes/apps/paperless/barman-creds-externalsecret.yaml
+++ b/kubernetes/apps/paperless/barman-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: barman-cloud-creds
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (barman creds).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (barman creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/paperless/hetzner-creds-externalsecret.yaml b/kubernetes/apps/paperless/hetzner-creds-externalsecret.yaml
index 9adfa1d3..e547d073 100644
--- a/kubernetes/apps/paperless/hetzner-creds-externalsecret.yaml
+++ b/kubernetes/apps/paperless/hetzner-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/paperless/objectstore.yaml b/kubernetes/apps/paperless/objectstore.yaml
index 7f3c55e2..03d006bf 100644
--- a/kubernetes/apps/paperless/objectstore.yaml
+++ b/kubernetes/apps/paperless/objectstore.yaml
@@ -5,7 +5,7 @@ metadata:
   name: pprl-pg-store
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:
diff --git a/kubernetes/apps/paperless/scheduled-backup.yaml b/kubernetes/apps/paperless/scheduled-backup.yaml
index 0e01dfa7..df727913 100644
--- a/kubernetes/apps/paperless/scheduled-backup.yaml
+++ b/kubernetes/apps/paperless/scheduled-backup.yaml
@@ -11,7 +11,7 @@ metadata:
   name: pprl-pg-daily
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 30 2 * * *"
diff --git a/kubernetes/apps/woodpecker/hetzner-creds-externalsecret.yaml b/kubernetes/apps/woodpecker/hetzner-creds-externalsecret.yaml
index b5774e39..cbf1feb0 100644
--- a/kubernetes/apps/woodpecker/hetzner-creds-externalsecret.yaml
+++ b/kubernetes/apps/woodpecker/hetzner-creds-externalsecret.yaml
@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: apps
   annotations:
-    # Prune-disabled ahead of the seed->dedicated-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
diff --git a/kubernetes/apps/woodpecker/objectstore.yaml b/kubernetes/apps/woodpecker/objectstore.yaml
index 4f03c40f..974a967a 100644
--- a/kubernetes/apps/woodpecker/objectstore.yaml
+++ b/kubernetes/apps/woodpecker/objectstore.yaml
@@ -5,7 +5,7 @@ metadata:
   name: wp-pg-store
   namespace: apps
   annotations:
-    # Prune-disabled ahead of the seed->dedicated-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:
diff --git a/kubernetes/apps/woodpecker/scheduled-backup.yaml b/kubernetes/apps/woodpecker/scheduled-backup.yaml
index f384b32c..b33c61a9 100644
--- a/kubernetes/apps/woodpecker/scheduled-backup.yaml
+++ b/kubernetes/apps/woodpecker/scheduled-backup.yaml
@@ -9,7 +9,7 @@ metadata:
   name: wp-pg-daily
   namespace: apps
   annotations:
-    # Prune-disabled ahead of the seed->dedicated-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 35 2 * * *"