diff --git a/k8s/security/ci-cd/sops-cmp-plugin.yaml b/k8s/security/ci-cd/sops-cmp-plugin.yaml
index bb40815..f3f2a20 100644
--- a/k8s/security/ci-cd/sops-cmp-plugin.yaml
+++ b/k8s/security/ci-cd/sops-cmp-plugin.yaml
@@ -60,7 +60,9 @@ data:
 
     # ── grafana (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"
-    emit_secret logging grafana-admin \
-      admin-password=.adminPassword
+    # grafana chart's admin.existingSecret needs BOTH admin-user and admin-password.
+    printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: grafana-admin\n  namespace: logging\ntype: Opaque\ndata:\n  admin-user: %s\n  admin-password: %s\n---\n' \
+      "$(printf 'admin' | base64 -w0)" \
+      "$(echo "$DEC" | yq -r '.adminPassword' | base64 -w0)"
     emit_secret logging grafana-oidc \
       GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET