diff --git a/cluster/platform/harbor/README.md b/cluster/platform/harbor/README.md
index 4f95093..571c43c 100644
--- a/cluster/platform/harbor/README.md
+++ b/cluster/platform/harbor/README.md
@@ -45,18 +45,36 @@ The Job:
 
 **Note:** ArgoCD PostSync hooks don't currently trigger with multi-source applications, so the Job must be run manually after initial deployment or when robot account definitions change.
 
-### Retrieving Robot Credentials
+### Managing Robot Credentials
 
-Robot account secrets are only returned on creation. To regenerate a secret:
+Robot account secrets are managed through 1Password and synced via ExternalSecrets:
 
-```bash
-curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
-  "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/<robot_id>" \
-  -H "Content-Type: application/json" \
-  -d '{"secret": ""}' | jq -r '.secret'
-```
+1. **Initial Setup:** After running `robot-accounts-sync.yaml`, regenerate secrets to capture full values:
+   ```bash
+   # Regenerate tekton-builder secret (robot ID: 3)
+   curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
+     "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/3" \
+     -H "Content-Type: application/json" \
+     -d '{"secret": ""}' | jq -r '.secret'
+   
+   # Regenerate fastpass-cluster secret (robot ID: 4)
+   curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
+     "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/4" \
+     -H "Content-Type: application/json" \
+     -d '{"secret": ""}' | jq -r '.secret'
+   ```
 
-Store secrets in 1Password (mk-labs vault, item: `harbor-robot-accounts`).
+2. **Store in 1Password:** Create item `harbor-robot-accounts` in mk-labs vault with fields:
+   - `tekton-builder-username`: `robot$tekton-builder`
+   - `tekton-builder-password`: (secret from above)
+   - `fastpass-cluster-username`: `robot$fastpass-cluster`
+   - `fastpass-cluster-password`: (secret from above)
+
+3. **ExternalSecrets:** Two ExternalSecrets automatically sync credentials from 1Password:
+   - `externalsecret-tekton-robot.yaml` → creates `harbor-tekton-robot` secret
+   - `externalsecret-pull-secret.yaml` → creates `harbor-pull-secret` secret
+   
+   Both create `kubernetes.io/dockerconfigjson` type secrets ready for use.
 
 ## Network & TLS