diff --git a/apps/notesnook/kustomization.yaml b/apps/notesnook/kustomization.yaml
index a33ee61..41354d9 100644
--- a/apps/notesnook/kustomization.yaml
+++ b/apps/notesnook/kustomization.yaml
@@ -4,6 +4,7 @@ namespace: notesnook
 resources:
   - namespace.yaml
   - notesnook-config.yaml
+  - notesnook-sealedsecret.yaml
   - db-service.yaml
   - db-statefulset.yaml
   - db-init-job.yaml
diff --git a/apps/notesnook/notesnook-sealedsecret.yaml b/apps/notesnook/notesnook-sealedsecret.yaml
new file mode 100644
index 0000000..7d4a030
--- /dev/null
+++ b/apps/notesnook/notesnook-sealedsecret.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: notesnook-secret
+  namespace: notesnook
+spec:
+  encryptedData:
+    MINIO_ROOT_PASSWORD: AgDAj0bx9aNQHIXAcNB3YfA4+P5qIhVNwEDBDDTEcJ9OQ3qrmTrZ0HtYIWswMU1CYuCGzfCT9sdoJ94L4VFWCdqavHdPn3/zDtXXR7WAaMOoYygiKIPTVO1rmRNnk0gzirl1aWSm+fWsc61+SYCvx08C/RnSyTeocfhpY0rvm0r9eiIxmdjc0u2VKksh1ARSkSqJkLniPXBH6PCFH/tUOH3FZqYycCW+FEhj8KE9D/FIVKy3pCFhfg9KfH7XHqQx5wnQ0j2aL9ljqA6DPI6tDB5rcR8lW7+3iC8X3YZwaExFfWq+3ksZj5LLnESBlqwvV1IY8B7k1VoiL8f5r/5VAE/EJ6SFvIueoOnKxUWC+NJroWeBSnk0isDpNPluVkrGJOVTHv0bx3bAhUVjr3lQsimvyi1ZZXKvr/b/Hpg++RLTF3wBGLjM7tsJ0RHnzysvIyfg8euU2OYitjfkQKbvDIREkU5A0AQ35oapgNnVAB2gWlm4SAkkfOQuT/oowTOLEYKg4zzk64lQiOWFtD5q82Dr6PU6s/snIDixkY/5ICgcV5/Y1Oq0wtvhblDBroWpEnohoQAqlYkRNN4jh+oSEJwJORv6mF370XxBxY9k3h/IyCdJeC9xv9DocUjUP+FU9HQE7Qvd3OcNag1DAyhmtLv5wDgZEea3fPX5XMhnvE5U+YUxZDXkN1MchItTTMMim5fySIPg5KZ+Hr2Ticpxfjw47RMFNH3y2qfDqb8hBfB9SA==
+    MINIO_ROOT_USER: AgAyLNT8gHmThqLjQBBcmoZsxtEG/ZR/hjUICEZKAyF8+FV6A3WFizA8tYBzjNyfaGFSdS2yLmZGbwtEKmHSApBmXoY4xgnyZpEjh2whsgeBjMFdx2jWt+odvEaPGA+xEbuODJbkJMQiXhi/ctyiMD1/y6WIWZ5Ya8Ahz469di0fT1znMk9B050FKFgVEK6Sfzb8MQuZBj2wukTgZ2rlKMQ+7EQi6pb6cEATLDjheXvbgx4g9LTPwVN+1uZcC5GU7jg/IGJcEg/QJfmOCgRmz9iDx3/d9lFnDnJBOv8Plt6PmWEMR9QOvdQjUhWiN2BwrdICHqFxFTnV+z9JbMk2kT2Ovw6W239BT+KbabEaiwVE5+3ubLLymF3bXwRO7fqPO3xy6/aVsv6k9995jPY7/DNIr5kozo/uFf2DeP8sbldJp2ymR2RBoa8TCiGHT5pgWr36qHxMt1J7fU1mWIRPeUmkFJchCjNc8qDr1bwY9hjrdXxC5fUkFsG/gyb5FsmzvQaAPAy45Wl1DRpp4xBiE/SUc+xBcA1y3Bo6lJ2w7w8tB2bMZUqZkgOyPDaPfzLViMtPUlnCnKRGzvi8HoGvzLS4gN1jjRUK33YtLpLqa6B9Wj1/fkgu9H1cIz1ffS3baL4ZIyA3K7/4LrAS2xzUcJ8HdezxjuZQKqtwDgJSysZJ0blXG6GLpx8JonZh4gx8na1c9kKt07BNYao=
+    NOTESNOOK_API_SECRET: AgC3JoH/PCMgUPPvUCkIsRWGEIJtwt+E+wXvfBTi2V60nN19RiJLpXF860UrKnFZxvloFalJLIxA1mtLUAfO2wZuzGpid8IIrAUIyhXCZkZWkZr9UbB/TjzmorC5NEAwjo08zhBKIlME+Emdb7BrpHGbj2ykQlyKqwCSTPKoitkypdgXQsbPWM6j03o/F9hSmKVFCTb6ugBY72rXBlVBqBGdeoPLkwSnuk7kk6y+lOfufeqGw2MXoNCZJ1+rbZQ2ihGFSGLKd955I3wnidcu8oCQO50u4V1IHhj0/iJHh/bXu6ipXEw4ZX886SFQgqqb36sFt8b2PIk+h2GtqFC+Ixew+ay790B/wXIMWhze680oAwq/6ZvWe0PSbJgDXLCYga7ZIw8RYFphk3+VblYfc9EObGWvuLDoGzSs/qgi/+euxOkM1P8lGUGuSETz4Bm7VEg4udEneuCnfHqQ19/qkhu/isMwN7KpOaymKwpw0Yb2oefUljjPOGHq+ni08TUU1V+fmKMmnxG3Uq05mLDjTpN6lkpm5yF5xCA4WRflL1kqLFsCPm4JF62NiLDXuVb7c0uz9l85YaJg06RaYVHOf5Km7B3wnBHHrk8sJ2NtkUa2vvGbkZ64JFP9PrD7Ubvh62i4QoXn83nv67rihtzB8BNzkA7sQVLH2OpBqFkbJaTquBWXo3zg8AWcxpuXvNXv6ba4kZJEbBbCDpQDUdQ//MSJttHEgPKvZgmqtqCQ7W3Mypr6CWWGhSfcEmgAzcSfYlYNAbGAGxFErDkXelhbsgNr
+    S3_ACCESS_KEY: AgC9kcAVZEpanlIjfkpJjDDJe6nikUTorye4l03NhgOoMrU6ivxVXBboiXAYyRYYRidp60r041YPs5lZNCYOwwpuf5iquAlAuD5mecR2xFJIsv3Mxi5wEdoFvPtCIFv8Xm0MTMvR1ch4J4X1gds4S3HQmYIxEKSg/qU+/4ww1CccbDexGOhwOwMMor2KZwfGTrDIZO7/3SwMQs6h8XVRUR5BhuLGftV6tUFEOQBQ6pjijurkSW/faG6YJbE2hpmWNdot6Qau7matCcJhRZI0NAeZhAPeCvIlyrEyJpqjMxNEMVJszj//F7dlPxTW8AkWyw2bmzzgNPhAYvpRTxrDDr70huRUWIo5mAlBbJypT3haVjKYFoRKAGXWC/8dhLSp3NKWQ/smBzpvUOQ30N4EskIVT+V8GArkrLN35yi2yP1aFaQpvLCA1m8pp5hUTgyDm1dqcOnQg3DRJgiMN7/Jt+P9TQGs2RiKoHCPp6lIfDGRKDLYeG5uuiUouridf1HnkrKGXlSmnd4xYWYlym6ZAC7Uzd9GlwTeZwZT8YJCQHqnZFPGq6MAVOPR5B+kQldAH81qosXjRdQyn8RT3DefdAjbduh4/DzuLJTTu8OeSmyPx7H5uqDIrkn1DLuBca2+lJPu4xMv6bthGRzwBLA1aU+nmniFBznkg+YlI5XxJLrA5Ra/PZsglhCHRz1hSiajZ5g1jUzMk2XDjti/q3Xbqj1AkmLmKjZbR05e7VRELMIj4g==
+    S3_ACCESS_KEY_ID: AgAjLq/HHmD30h2/2mHU/iQKS6l4PRTRhquB4UgCdJjkr/a4eGfxxPZWRJJrj/AbFaWQrAq/ADqa9cAxwXsJInwVLkmv42sB9hODGxRtKbQgwubJaa84uOqdNvce/GvlxXrVIh5H7GUTTKuIXSuS5U/AtBniPudJ5/p8QulYXyqY3K34uePIMEqBP5m7CJ8kKB7EPTLvb29pjr/VdKCpSMwnhXiiiwU/Y1NDdf4ZiIc1gsp79kRd1RhFsLfJky/tBntv4waHHfYKZ7jkCJOGp189ZSqNFlAkP2TPg+jpygpznPvTTggQB45DlYKupUI1bMGlkWcfYLM9+/jmvHngGuzPvSUlGFukaPHkhJ8YwLz+Jc+K6xxdbX9WjzqqGYs3CW41ccxHjxgrZnUW62NbCYIR7xj1K2vCVmmyjwC++N9ArDvS/VreXAq2QJsxKQjL7YElsQrFlMzKrRw98kUd4vpQPQxK+nkLe9HVj0VJprDK22ZrfCcyA8rl64Zx8huwbKEmNscZou49oDx3LJRI8vGFS0lQJFLBrjJKjF9xT+7R59SIo+7JxFAWDvmEaJrdPSq4EDEturHhzvKcv5y1Gy1ul4nwIGvxDZAK9kwp5oiGxfARncoVzgFINqwlVmVfPRb4RZl5mzu8IToMebwvJ52Rpf+IhkW1yEnCYxppBNmUyPWewTc3UUvtViOOawaARaXii6O9sR0uhlE=
+    SMTP_HOST: AgBZiWzF45lbMOrRXlGi2k1jq2bA+hQWF1DVLJemKgn9et0uBfcIyICHS/7E4cukDI+MOInEQEYem5M4FoQ2mM2ylcIm+LrUI+p5azDKRYkkbcwKD2F0+J9G5YDXxYth11NzS3fLhrVxAuqmbqy3LxOmSkjFvFdJxLx0Su78B2CSDBXmy+gu4soY7bdQV0L3T/zfG6s1WuLzR8WPnji3EmBM5dexG7Smhziz0dymOuhdGfSwaI2MWrYzw9J3Vshc+mRXzw1JvI5mVbawhQOLrnW57NvXlJtk19LLr/kXWOt1ppJcJOYGOxWrFs4VA4Bg4QSN2piARWZ6FbL1/a8ynamUhw+R2yDlT/J8oQIVBzhIWCU5EwfHgDu+QRKzmd2iAhfYZjrUkJNojUjqaQvb7RXrG4DVL9UJxGjushebgc2EG/PykdzoRL2d1KMfJRK6O5ouM42UvOCqRzbBbWuTiA6fj8hGTIZYFXX3vWIM368uDvrEVxj2C+skrRzHEzAQgsJEaWtFvZm6WGkZZOLTuava9+JxMvnpftWMIE8FrYCAYwn5xa88eftgw+GW65EWVSm8IXFtGoNd4DKYj5OGF2DcN//OxteoVd3OxsmuJtY0Qx0REb9nqg9Qdw2bP6emmpmgtyw8opUS/VubGghdCnhLUES+CA08ooK4a8n8rZSSFiujvjMjoDdOnVktM/D3R6ECftJRakhMes4INANM4w==
+    SMTP_PASSWORD: AgAdjxnT2uC0LRUmlQ/BOlLs6l1PCP13tMmgmSnqqNWSuucYkWwTWtz4qBnG3dauhC0ufS5eqABJqZq0r+QpyhxU0Otqzk7oVcea0Mq9ai159IMCx/rZL8HXIkUF76muv8GOGDYlaf3A+CbrNTsaRXDbjZ7LjzD8OwsdfaeIzUejyNXgs5EMjSOHLx4YhmVfVEZLAtoP9zcNlDSNFaat79wnwjwUifHuY3usvQXhJS+vLVtLLtWwKF0rCsfkbCRwJtJCCrOvOLuid8aZ3cO9Y7n0+TOAlkSe4dSSq0D2psg3njEZ2l3RNLW2YbM2LkcXK+MjIpCivqSCXLufq1dUuhDxCirxSd0VgTt5TPgeTCi+kuNv/UAqydQWDQlh6izUDdnTtMlRqtk4ZFhoBvIo1NVdpObmbFlSlBURwrmNqmdyO1/MNZT40gi1UsuEtktDCohoq6zQrahiGqcXr1VVscE+u5VoV7PRTICMSJQexFV9fx8YsZxDycng7zaf6xbK0JWVSuU1IXwb1ZOReQs0MtZj45o/c9JtYS1HPoSZRCCSCAd6qPhnHoUc6jYYFznfKTqvrpSdXqoBF61I1Sw+CKuVA/aut9mgCzWIwGjb38Hjh/VYufrgkFMcvnqbpkX4F8sMvzI3zsvFT2S0RwNGHOay6f+otg2KJdPlE2HSLVGLTFxS1Ku2F3ZPL79/Br8eCW3PPnq4c6w4f0XBFtuGSXtt
+    SMTP_PORT: AgATegLz9D+74mUBak9tv+7L/LeRqcJXcE58T1fOh1shsz3KjSzuXb4HxytqghT0LqplAEemCPoG823wPFKYnxZtvedQ2CyZGCxEXPoV6iUvBAVC3Pj6H92k9CIEZRPHLvR6IR+mXzu6HLWwJsOGrxn28waSx374uVizylptkpjIHvyseY3chfH0N/x2tK0yZn9rKOqnzfjKVGh4DF+i7wU/uuFPhcMbqRPg70J0pxhesTKHBAerGnvfnoCxFRoSl0ZPgC0kK5NfIEp3zWW45NWshPNsbb0yix76Rnr+8dEn/Rbopa8jZtfdK260ZPclLRO6z04ks69Zp5u9kE1g883Q25I+M9C8B27QDC+KHxgSwq0w8a5CwlCYDRu/e9UBHtsJobRaARgghyyAVsS4FsDS45kJom3U7n0Ip/27hg2VMm+jwNRoB5cmlyhDDlFng49U36DRsd0z2d2wBFAG4NM4xgbWlK5zUDmKCveC7zJfFAuZGsMbY5U8/lDv1WvGIG8xmQsg5CgriVL6gG3ReRjk3BmK93b8OkUhfquFHKBoyqJZWIIz+W5dcP2fKdjZc0Ec2vPqszHaNTN+dEcGzm9MGFpeus6rA6Egxzq1esVbEPuixcI6eXc87SOG0Ntn2wbPJQKpNZq+JkzYSXBUZcemPz5M2nybLr/lwuX7//Qg5b95nwzXMRRm9kagwWubDPNPpd8=
+    SMTP_USERNAME: AgAxdxvMjUjvj8vYu8upKMfpAIi00dBizXD83F5f6TCSlAFlo3kuVFbfJ8tCQZNRSdU7vP6n3zQfW2IhYUQSnO44+Wb8q5V4sfs1cClbPyGpQdEyFeLk1KwW3LeFxsi9cym3H7Qtu9e/S3dOmD9IxK8AuOJkq5t7Xepum7WvuOuvBVFm2nVetZlTs1BmHoxA8dHlAhk+qwGMAuo/Xltut67uDsPzZTcA4fEAYe+We7zqfD0hpN+k1TffZHE7x+GpA3tyc6yUf/uSsWRq9HKyASc0UM5uoK/WoxYoUA7RF5j5FXFrA1jY/Y1pE3oLjQmpB59q5vOasd77uXE/1b+rs6l8L1zngWw+8MeKA/julrmWBwte+vs68yqDFOL7QNfwpYmYoaAcuvezeXZwF4nnwzXyE8ZEO7xtbp/r9DATeGypjRnm1bDAMTARGLgHoxV18UELCiksNNCbVO7twXJs+HUE/sbfI3tQmk6O5zbWD/GbcR0lTsTjM+hcM5r9ZYfrq7Ad3Oyb3ANU184Rm4fiR9v+t9OyJf9jIASF9p8oFcTr2dupdv3r8wzPq/ayfvN44nyOr2xVfIv+ubMqjjLixg0jUDeFoR/GST6fpvWBmd2HVMG1tHvZxphUb0V/M946HxKBMpsFn/WWyLgUzJG64bIICDAetCferbaa4UFEHP23G/R5tLBWM2GNZpT6yfkBQYppc6e1/KAjGNVMrTpKQeNkD/xs
+  template:
+    metadata:
+      annotations:
+        sealedsecrets.bitnami.com/managed: "true"
+      name: notesnook-secret
+      namespace: notesnook
+    type: Opaque
diff --git a/apps/notesnook/notesnook-secret.yaml.example b/apps/notesnook/notesnook-secret.yaml.example
index e492e11..847d80d 100644
--- a/apps/notesnook/notesnook-secret.yaml.example
+++ b/apps/notesnook/notesnook-secret.yaml.example
@@ -1,19 +1,25 @@
-# DO NOT COMMIT THE REAL VERSION. Copy to notesnook-secret.yaml (gitignored),
-# fill real values from the old stack's .env, then:
-#   kubectl apply -f apps/notesnook/notesnook-secret.yaml
-# ArgoCD ignores this Secret's /data (see argocd/notesnook.yaml).
-apiVersion: v1
-kind: Secret
-metadata:
-  name: notesnook-secret
-  namespace: notesnook
-stringData:
-  NOTESNOOK_API_SECRET: "CHANGE_ME"
-  SMTP_USERNAME: "funman300@gmail.com"
-  SMTP_PASSWORD: "CHANGE_ME"
-  SMTP_HOST: "smtp.gmail.com"
-  SMTP_PORT: "587"
-  MINIO_ROOT_USER: "notesnook"
-  MINIO_ROOT_PASSWORD: "CHANGE_ME"
-  S3_ACCESS_KEY_ID: "notesnook"
-  S3_ACCESS_KEY: "CHANGE_ME"
+# NOTE: This app's Secret is now managed via SealedSecrets (notesnook-sealedsecret.yaml),
+# which IS committed (encrypted). You should not need to hand-apply a plain Secret.
+#
+# This file remains only as documentation of the required keys.
+#
+# To change a secret value:
+#   1. Build a plain Secret locally (NEVER commit it):
+#        kubectl -n notesnook create secret generic notesnook-secret \
+#          --from-literal=KEY=value ... --dry-run=client -o yaml > /tmp/s.yaml
+#   2. Seal it:
+#        kubeseal --format yaml --scope strict < /tmp/s.yaml \
+#          > apps/notesnook/notesnook-sealedsecret.yaml
+#   3. Commit the SealedSecret; ArgoCD applies it, controller unseals it.
+#
+# DISASTER RECOVERY: the controller's private key is backed up GPG-encrypted at
+#   /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg  (passphrase in password manager)
+# Restore it BEFORE applying SealedSecrets to a rebuilt cluster:
+#   gpg -d master-key-YYYYMMDD.gpg | kubectl apply -f -
+#   kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
+#
+# Required keys:
+#   NOTESNOOK_API_SECRET   (reuse existing — do NOT regenerate)
+#   SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT
+#   MINIO_ROOT_USER, MINIO_ROOT_PASSWORD
+#   S3_ACCESS_KEY_ID (= MINIO_ROOT_USER), S3_ACCESS_KEY (= MINIO_ROOT_PASSWORD)
diff --git a/argocd/notesnook.yaml b/argocd/notesnook.yaml
index d5f03f6..e31facb 100644
--- a/argocd/notesnook.yaml
+++ b/argocd/notesnook.yaml
@@ -12,13 +12,6 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: notesnook
-  ignoreDifferences:
-    - group: ""
-      kind: Secret
-      name: notesnook-secret
-      namespace: notesnook
-      jsonPointers:
-        - /data
   syncPolicy:
     automated:
       prune: true