diff --git a/servers/gcp/k8s/gitea/external-secrets.yaml b/servers/gcp/k8s/gitea/external-secrets.yaml
index 07b13a0..20fae46 100644
--- a/servers/gcp/k8s/gitea/external-secrets.yaml
+++ b/servers/gcp/k8s/gitea/external-secrets.yaml
@@ -7,7 +7,7 @@
 # Pre-requisite: install ESO on GKE before applying this:
 #   helm install external-secrets external-secrets/external-secrets \
 #     --namespace external-secrets --create-namespace
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: SecretStore
 metadata:
   name: gcp-secretmanager
@@ -47,7 +47,7 @@ spec:
 # ACTUAL APPROACH: ExternalSecret pulls the full DSN string into a k8s Secret
 # key "dsn". A separate gitea-db secret provides just the password field.
 # Terraform outputs both; add a gitea-db-password Secret Manager secret in cloud-sql.tf.
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: gitea-db