diff --git a/gitea/application.yaml b/gitea/application.yaml
index 2729a3e..cbb47cb 100644
--- a/gitea/application.yaml
+++ b/gitea/application.yaml
@@ -16,6 +16,15 @@ spec:
 
 # Gitea DOES NOT go through Traefik. It has its own IP because ssh :22 would conflict with kube worker ssh. On its own IP, at the moment it doesn't flirt with Traefik — also has its own certificate.
 ---
+# After the 2026-09 breach (CVE-2026-59774) all three secrets below leaked
+# because they shared one generated value. INTERNAL_TOKEN and JWT_SECRET were
+# moved to their own claims (gitea-internal-token, gitea-oauth2-jwt) and rotated;
+# the StatefulSet now reads those two from the new claims, so the copies here are
+# unused. SECRET_KEY is intentionally still sourced from this claim and NOT
+# rotated: a new value would make data-at-rest (push-mirror creds, 2FA)
+# undecryptable and break the 2 push mirrors, whose credentials must be re-entered
+# by hand. Do not shrink this mapping: the operator would regenerate the plaintext
+# and change SECRET_KEY. Rotate SECRET_KEY in a maintenance window instead.
 apiVersion: codemowers.cloud/v1beta1
 kind: SecretClaim
 metadata:
@@ -31,6 +40,26 @@ spec:
       value: "%(plaintext)s"
 ---
 apiVersion: codemowers.cloud/v1beta1
+kind: SecretClaim
+metadata:
+  name: gitea-internal-token
+spec:
+  size: 32
+  mapping:
+    - key: GITEA__SECURITY__INTERNAL_TOKEN
+      value: "%(plaintext)s"
+---
+apiVersion: codemowers.cloud/v1beta1
+kind: SecretClaim
+metadata:
+  name: gitea-oauth2-jwt
+spec:
+  size: 32
+  mapping:
+    - key: GITEA__OAUTH2__JWT_SECRET
+      value: "%(plaintext)s"
+---
+apiVersion: codemowers.cloud/v1beta1
 kind: OIDCClient
 metadata:
   name: gitea
@@ -220,12 +249,12 @@ spec:
             - name: GITEA__OAUTH2__JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: gitea-random
+                  name: gitea-oauth2-jwt
                   key: GITEA__OAUTH2__JWT_SECRET
             - name: GITEA__SECURITY__INTERNAL_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: gitea-random
+                  name: gitea-internal-token
                   key: GITEA__SECURITY__INTERNAL_TOKEN
             - name: GITEA__SECURITY__SECRET_KEY
               valueFrom: