diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml
index 328fcc9..a56d0e7 100644
--- a/k8s/argocd/apps/00-secrets.yaml
+++ b/k8s/argocd/apps/00-secrets.yaml
@@ -20,7 +20,6 @@ spec:
     repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/security/sops-secrets
-    plugin: {}
+    directory: {}
   destination:
     server: https://kubernetes.default.svc
-  revisionHistoryLimit: 3
diff --git a/k8s/security/ci-cd/argocd-values.yaml b/k8s/security/ci-cd/argocd-values.yaml
index e1c6df5..95f5046 100644
--- a/k8s/security/ci-cd/argocd-values.yaml
+++ b/k8s/security/ci-cd/argocd-values.yaml
@@ -47,15 +47,6 @@ configs:
       g, homelab-admins, role:admin
     policy.default: role:readonly
 
-  cmp:
-    plugins:
-      sops-secrets:
-        generate:
-          command: sh
-          args:
-            - -c
-            - /var/run/argocd/plugins/sops-cmp-generate.sh
-
 server:
   replicas: 1
   deploymentStrategy:
@@ -99,26 +90,6 @@ repoServer:
     enabled: true
     serviceMonitor:
       enabled: true
-  extraContainers:
-    - name: sops-cmp
-      image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
-      command: [/var/run/argocd/argocd-cmp-server]
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
-      volumeMounts:
-        - mountPath: /var/run/argocd
-          name: var-files
-        - mountPath: /home/argocd/cmp-server/plugins
-          name: plugins
-        - mountPath: /tmp
-          name: tmp
-        - mountPath: /sops-age
-          name: sops-age
-  volumes:
-    - name: sops-age
-      secret:
-        secretName: sops-age
 
 applicationSet:
   replicas: 1
diff --git a/k8s/security/sops-secrets/00-README.md b/k8s/security/sops-secrets/00-README.md
new file mode 100644
index 0000000..942cf5d
--- /dev/null
+++ b/k8s/security/sops-secrets/00-README.md
@@ -0,0 +1,6 @@
+# SOPS-Decrypted Secrets
+
+Placeholder for CMP-generated secrets (pending full CMP plugin setup).
+
+Currently, manually-created Secrets live in individual namespaces (e.g., grafana-admin in logging/).
+Once the CMP plugin is wired, this Application will decode *.enc.yaml and emit all Secrets here.