diff --git a/servers/legion/k8s/neuron-technologies/web/deployment.yaml b/servers/legion/k8s/neuron-technologies/web/deployment.yaml
index 4a7580d..2a85cc4 100644
--- a/servers/legion/k8s/neuron-technologies/web/deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/web/deployment.yaml
@@ -22,8 +22,10 @@ spec:
         app: neuron-web
         env: stage
     spec:
-      imagePullSecrets:
-        - name: registry-pull-secret
+      # The registry currently allows anonymous reads from the cluster; if we
+      # later flip it to require auth, add a registry-pull-secret here that
+      # ESO populates from Vault. See the mudcraft externalsecret-registry
+      # for the pattern.
       containers:
         - name: neuron-web
           image: registry.neuralplatform.ai/neuron-web:dev-dfe41234
diff --git a/servers/legion/k8s/neuron-technologies/web/kustomization.yaml b/servers/legion/k8s/neuron-technologies/web/kustomization.yaml
index 06aea8c..3b41c80 100644
--- a/servers/legion/k8s/neuron-technologies/web/kustomization.yaml
+++ b/servers/legion/k8s/neuron-technologies/web/kustomization.yaml
@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - registry-pull-secret.yaml
   - externalsecret.yaml
   - service.yaml
   - deployment.yaml
diff --git a/servers/legion/k8s/neuron-technologies/web/registry-pull-secret.yaml b/servers/legion/k8s/neuron-technologies/web/registry-pull-secret.yaml
deleted file mode 100644
index 3e76f7c..0000000
--- a/servers/legion/k8s/neuron-technologies/web/registry-pull-secret.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# registry-pull-secret — credentials for registry.neuralplatform.ai
-# pulled from Vault by ESO. Lets the deployment fetch
-# registry.neuralplatform.ai/neuron-web:* without baking creds into the manifest.
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: registry-pull-secret
-  namespace: neuron-web
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: registry-pull-secret
-    creationPolicy: Owner
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: |
-          {"auths":{"registry.neuralplatform.ai":{"username":"{{ .registry_user }}","password":"{{ .registry_docker_token }}","auth":"{{ list .registry_user .registry_docker_token | join ":" | b64enc }}"}}}
-  data:
-    - secretKey: registry_user
-      remoteRef:
-        key: secret/data/mudcraft
-        property: registry_user
-    - secretKey: registry_docker_token
-      remoteRef:
-        key: secret/data/mudcraft
-        property: registry_docker_token