diff --git a/k8s/apps/key-rotation-controller/rotations.yaml b/k8s/apps/key-rotation-controller/rotations.yaml
index 558ddab..b7a79ee 100644
--- a/k8s/apps/key-rotation-controller/rotations.yaml
+++ b/k8s/apps/key-rotation-controller/rotations.yaml
@@ -107,7 +107,11 @@ spec:
     secretName: minio-oidc
     secretNamespace: storage
     secretKeys:
-      secret: client-secret
+      # The key name here must match the consumer's secretKeyRef, not a house style.
+      # minio-tenant.yaml reads MINIO_IDENTITY_OPENID_CLIENT_SECRET. While this said
+      # `client-secret`, the tenant failed with CreateContainerConfigError on every
+      # restart and the rotation wrote a key nobody read.
+      secret: MINIO_IDENTITY_OPENID_CLIENT_SECRET
     reload: hot
     consumers:
       - {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}