diff --git a/cluster/platform/external-secrets/application.yaml b/cluster/platform/external-secrets/application.yaml
index c7832b9..6412cb0 100644
--- a/cluster/platform/external-secrets/application.yaml
+++ b/cluster/platform/external-secrets/application.yaml
@@ -1,6 +1,7 @@
 # ------------------------------------------------------------------------------
 # Platform: External Secrets Operator
 # Wave 1 — must be fully healthy before 1Password Connect (wave 2)
+# Multi-source: Helm chart from upstream + manifests from repo
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -11,13 +12,19 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   project: default
-  source:
-    repoURL: https://charts.external-secrets.io
-    chart: external-secrets
-    targetRevision: 0.14.4
-    helm:
-      valueFiles:
-          - values.yaml
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://charts.external-secrets.io
+      chart: external-secrets
+      targetRevision: 0.14.4
+      helm:
+        valueFiles:
+          - $values/cluster/platform/external-secrets/values.yaml
+    # Source 2: Repo — provides values file via $values ref
+    # No path here since external-secrets has no extra manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets