diff --git a/apps/base/forte-drop/kustomization.yaml b/apps/base/forte-drop/kustomization.yaml
index af947b2..83e7172 100644
--- a/apps/base/forte-drop/kustomization.yaml
+++ b/apps/base/forte-drop/kustomization.yaml
@@ -6,4 +6,8 @@ resources:
 - keycloak-client-forte-drop.yaml
 - forte-drop-pdb.yaml
 - forte-drop-secrets-sealed.yaml
-# - auth-oidc-sealed.yaml                   # added in follow-up commit (after Keycloak registrar creates client_secret)
+
+# NOTE: the web sidecar's auth-oidc SealedSecret is added in a follow-up commit,
+# once the Keycloak registrar has created forte-drop-oidc-credentials post-deploy
+# (see PR description for the one-time seal step). It is intentionally NOT a
+# resource here yet — sealing it requires the registrar-generated client-secret.