diff --git a/.gitignore b/.gitignore
index 382eebc..2118a86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,4 @@ talosconfig
 terraform/.terraform/
 terraform/.terraform.lock.hcl
 terraform.tfstate
-terraform/terraform.tfvars
+# terraform/terraform.tfvars is intentionally NOT ignored - zone ID is not sensitive
diff --git a/charts/kan/templates/external-secret.yaml b/charts/kan/templates/external-secret.yaml
index 4ab61f6..0457be7 100644
--- a/charts/kan/templates/external-secret.yaml
+++ b/charts/kan/templates/external-secret.yaml
@@ -3,6 +3,8 @@ kind: ExternalSecret
 metadata:
   name: kan-secrets
   namespace: kan
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   secretStoreRef: