diff --git a/servers/legion/k8s/gitea-runner/external-secrets.yaml b/servers/legion/k8s/gitea-runner/external-secrets.yaml
index a5a9a39..0f82d70 100644
--- a/servers/legion/k8s/gitea-runner/external-secrets.yaml
+++ b/servers/legion/k8s/gitea-runner/external-secrets.yaml
@@ -1,5 +1,6 @@
 ---
 # gitea-runner-secret — Gitea act-runner registration token
+# GITEA_INSTANCE_URL is static (not a secret); GITEA_RUNNER_REGISTRATION_TOKEN comes from Vault
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -13,12 +14,12 @@ spec:
   target:
     name: gitea-runner-secret
     creationPolicy: Owner
+    template:
+      data:
+        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
+        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
   data:
-    - secretKey: GITEA_INSTANCE_URL
-      remoteRef:
-        key: secret/data/gitea
-        property: instance_url
-    - secretKey: GITEA_RUNNER_REGISTRATION_TOKEN
+    - secretKey: runner_token
       remoteRef:
         key: secret/data/gitea
         property: runner_token