diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml
index c57fc99..951d6fd 100644
--- a/k8s/argocd/apps/30-security.yaml
+++ b/k8s/argocd/apps/30-security.yaml
@@ -115,6 +115,16 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: cicd
+  # Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
+  # so the pod rolls when that Secret changes. The chart does not render it, so
+  # Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
+  # would fight over the field and Recreate the forge each round.
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      name: forgejo-gitea
+      jqPathExpressions:
+        - '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
   syncPolicy:
     syncOptions:
       # Adopt the objects the bootstrap Helm release already created rather