diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
index 4ad62e3..cf6d45a 100644
--- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
+++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
@@ -102,6 +102,20 @@ persistence:
   accessModes:
     - ReadWriteOnce
 
+# Pod annotations.
+#
+# GITEA__DATABASE_PASSWD comes from forgejo-db-app, a Secret the CNPG Cluster CR owns
+# and generates: cloudnative-pg created it, and there is no bootstrap secret, so
+# nothing else knows that password. The Deployment reads it into the environment at
+# start, so a regenerated password would leave Forgejo authenticating with a value the
+# database no longer accepts — the pod stays up and every query fails.
+#
+# The cnpg.io/reload label on the Secret is only a hint. This annotation is what makes
+# Stakater Reloader restart the pod when the Secret changes, so the environment is
+# refreshed instead of silently stale.
+podAnnotations:
+  reloader.stakater.com/auto: "true"
+
 # Ingress
 ingress:
   enabled: true