diff --git a/helm/trakrf-backend/templates/secret.yaml b/helm/trakrf-backend/templates/secret.yaml
index dc92def..05e98bf 100644
--- a/helm/trakrf-backend/templates/secret.yaml
+++ b/helm/trakrf-backend/templates/secret.yaml
@@ -6,6 +6,19 @@ metadata:
     {{- include "trakrf-backend.labels" . | nindent 4 }}
 type: Opaque
 stringData:
+  {{- /*
+    JWT_SECRET is intentionally NOT rendered when it's the placeholder default
+    ("change-me") or empty. The real value is set out-of-band (operator kubectl
+    today; External Secrets + GCP Secret Manager later — TRA-375). If the chart
+    rendered "change-me", ArgoCD would own and REVERT the operator-set value on
+    every sync/image-update, and the backend's fail-fast guard (TRA-860) would
+    then refuse to boot — which silently stalled preview rollouts. Omitting the
+    key means ArgoCD never manages /data/JWT_SECRET, so the out-of-band value
+    persists across all sync paths. (The trakrf-backend Application also carries
+    an ignoreDifferences carve-out on this key as belt-and-suspenders.)
+  */}}
+  {{- if and .Values.secrets.jwtSecret (ne .Values.secrets.jwtSecret "change-me") }}
   JWT_SECRET: {{ .Values.secrets.jwtSecret | quote }}
+  {{- end }}
   RESEND_API_KEY: {{ .Values.secrets.resendApiKey | quote }}
   SENTRY_DSN: {{ .Values.secrets.sentryDsn | quote }}