diff --git a/bootstrap.sh b/bootstrap.sh
index cca24eb..5ee59fd 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -82,6 +82,12 @@ kubectl get secret ddb-cluster-app -n ddb -o yaml \
   | sed 's/namespace: ddb/namespace: cicd/' \
   | kubectl apply -f -
 
+# Copy DB secret to iam namespace (for authentik)
+log "Copying ddb-cluster-app secret to iam namespace..."
+kubectl get secret ddb-cluster-app -n ddb -o yaml \
+  | sed 's/namespace: ddb/namespace: iam/' \
+  | kubectl apply -f -
+
 # 7. Wait for Forgejo
 log "Waiting for Forgejo to be ready..."
 kubectl wait --for=condition=available --timeout=600s \
diff --git a/k8s/security/iam/kustomization.yaml b/k8s/security/iam/kustomization.yaml
index 671a4ee..57f060c 100644
--- a/k8s/security/iam/kustomization.yaml
+++ b/k8s/security/iam/kustomization.yaml
@@ -15,7 +15,6 @@ resources:
   - key-rotation-cronjob.yaml
   - authentik-provision-job.yaml
   - rbac-dashboard-rolebinding.yaml
-  - sync-db-credentials-job.yaml
 
 # Provisioning/verification python lives in scripts/*.py (real files, linted +
 # diff-friendly) and is generated into ConfigMaps here rather than embedded in
diff --git a/k8s/security/iam/sync-db-credentials-job.yaml b/k8s/security/iam/sync-db-credentials-job.yaml
deleted file mode 100644
index 448078e..0000000
--- a/k8s/security/iam/sync-db-credentials-job.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-# PostSync Job to copy ddb-cluster-app credentials to iam namespace
-# Allows authentik to reference 'app' user credentials locally
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: sync-db-credentials
-  namespace: iam
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: secret-copier
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: sync-db-credentials
-subjects:
-  - kind: ServiceAccount
-    name: sync-db-credentials
-    namespace: iam
-roleRef:
-  kind: ClusterRole
-  name: secret-copier
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: sync-db-credentials
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  backoffLimit: 3
-  template:
-    spec:
-      serviceAccountName: sync-db-credentials
-      restartPolicy: Never
-      containers:
-      - name: copy-secret
-        image: alpine/k8s:1.30.3
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          echo "Copying ddb-cluster-app secret from ddb to iam namespace..."
-          
-          # Get secret from ddb namespace
-          kubectl get secret ddb-cluster-app -n ddb -o json | \
-            jq 'del(.metadata.namespace, .metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.ownerReferences) | .metadata.namespace="iam"' | \
-            kubectl apply -f -
-          
-          echo "Secret copied successfully"