diff --git a/gitea/application.yaml b/gitea/application.yaml
index cbb47cb..8c73ee4 100644
--- a/gitea/application.yaml
+++ b/gitea/application.yaml
@@ -49,12 +49,17 @@ spec:
     - key: GITEA__SECURITY__INTERNAL_TOKEN
       value: "%(plaintext)s"
 ---
+# size 43: GITEA__OAUTH2__JWT_SECRET must base64url-decode to exactly 32 bytes.
+# A 43-char value decodes to 32 bytes; a 32-char one decodes to 24 and Gitea
+# rejects it and generates its own key each boot, which (app.ini is on an
+# emptyDir) changes on every restart and logs out all OAuth2 clients. 43 keeps
+# the rotated key valid and stable.
 apiVersion: codemowers.cloud/v1beta1
 kind: SecretClaim
 metadata:
   name: gitea-oauth2-jwt
 spec:
-  size: 32
+  size: 43
   mapping:
     - key: GITEA__OAUTH2__JWT_SECRET
       value: "%(plaintext)s"