diff --git a/servers/gcp/k8s/gitea/external-secrets.yaml b/servers/gcp/k8s/gitea/external-secrets.yaml
index 20fae46..96d32c5 100644
--- a/servers/gcp/k8s/gitea/external-secrets.yaml
+++ b/servers/gcp/k8s/gitea/external-secrets.yaml
@@ -16,8 +16,15 @@ spec:
   provider:
     gcpsm:
       projectID: neuron-785695
-      # Workload Identity is used automatically — no explicit auth needed
-      # when the pod's ServiceAccount has the iam.gke.io/gcp-service-account annotation.
+      # Workload Identity — ESO impersonates the gitea-gke GCP SA to access
+      # Secret Manager. The gitea SA has secretAccessor on gitea-db-password.
+      auth:
+        workloadIdentity:
+          clusterLocation: us-central1
+          clusterName: neuron-platform
+          serviceAccountRef:
+            name: gitea
+            namespace: gitea
 ---
 # gitea-db — Gitea database password, pulled from GCP Secret Manager.
 # The Secret Manager secret "gitea-database-url" stores the full DSN, but we