diff --git a/infrastructure/configs/monitoring/secret.sops.yaml b/infrastructure/configs/monitoring/secret.sops.yaml
index 13a7c53..fe64d6b 100644
--- a/infrastructure/configs/monitoring/secret.sops.yaml
+++ b/infrastructure/configs/monitoring/secret.sops.yaml
@@ -5,7 +5,7 @@ metadata:
     namespace: monitoring
 type: Opaque
 stringData:
-    admin-user: ENC[AES256_GCM,data:fMJ90lg=,iv:vOqLwxnxaBr5grmjgVfIkHOA76r5ECCmn+dxwxJ8v3Q=,tag:csiDqkONejbpyn+c54WC8g==,type:str]
+    admin-user: ENC[AES256_GCM,data:DIZEGbpSfxHB8Qs=,iv:JmBr2VvPEgudEK5xXMCZVbo5QKdnHFAStI1mtxxv/mQ=,tag:Vt3IwD1BgJuQq7jPkB+CIQ==,type:str]
     admin-password: ENC[AES256_GCM,data:029sxX8MPFsDCrkHHCYd2e7vZv6beBmXRTDxhtKKa0M=,iv:SJd8Vz1hrMqzxcZ9/kH9q5xNOtUDqmTLltIaHtYpAYw=,tag:gH7g7ra9E2A7XQNTROmSrw==,type:str]
     oidc-client-secret: ENC[AES256_GCM,data:vVz8nQRKEdSeVKUvPZjbH3Bgi0TSetfDtoe8LZVNZ2+MN1yIVA2cGjDaLphrODJNozmJOg0Xpux6vUDC5PvKnQ==,iv:ezkCA3ePrCGPhNh9CNCXoageI8X3QIFV5+QXFWvhwOg=,tag:0uP7gekPgeYsvvbiyF6sSA==,type:str]
 sops:
@@ -29,6 +29,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1c9jlhvq47psz20sl2wu7d2jwstjjylfx769tuumree8hdf5klf2sjluulk
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-10-12T18:41:13Z"
-    mac: ENC[AES256_GCM,data:s3vubPYyrpMSE3/PgS2K378i8/HEABBfmDQyw87yTeLDC1GFcXmNB2RiOXKgWk2+t11P0KctgmOA8L9V3j+HnkZ1wj9IUy3gFBs51Tdhszq6dNR7AGzidCTm1KHFqCzGj+UFzqfbUTSaa/GREWqsHYuinebp0QP1blZ/GcawaMY=,iv:eI/JTVaQV6OdyFSETuKLbs02vgQBLCOeuD9jwHCnhv8=,tag:CdQ2diMLipsEYTT+opltxA==,type:str]
+    lastmodified: "2026-10-12T19:06:48Z"
+    mac: ENC[AES256_GCM,data:DRwrlXi3hw8/j+ZL8CM1svQn+qlvS35k1dPz/7b+Fd395RB+idYGUjrAeScLt+Z4NMKKo2aC2UzsMSdramX/MR49Xd2H+F0IcI28JSYi43Ua9/b55YXQQMunm8F1vFV7x1zhjor/m4sTxVCNt3m7PLQ9YDIgWuxxV1WfxevsaIw=,iv:znRQ+qTSd6Qy11T7caQZOr+4eJMq/32HIgiTWPm0sW4=,tag:rGCfzQD0Hlktk6sBN9lHdw==,type:str]
     version: 3.13.3
diff --git a/infrastructure/configs/monitoring/stack.yaml b/infrastructure/configs/monitoring/stack.yaml
index f613c8e..a2b9cb7 100644
--- a/infrastructure/configs/monitoring/stack.yaml
+++ b/infrastructure/configs/monitoring/stack.yaml
@@ -132,10 +132,15 @@ spec:
         limits: { memory: 384Mi }
       # Local admin: used by the dashboard/datasource sidecars (basic auth against the reload API) and as break-glass
       # sign-in at /login?disableAutoLogin if Ory is down; the login form is hidden otherwise.
+      # Its login must not match any Ory username: Grafana refuses to create an SSO user whose login or email is
+      # taken ("User sync failed"), and it does not link accounts by login.
       admin:
         existingSecret: grafana
         userKey: admin-user
         passwordKey: admin-password
+      # Bump when the Secret grafana changes: the pod restarts and, with no PVC, recreates its database.
+      podAnnotations:
+        bulbashenko.com/secret-revision: "2"
       envValueFrom:
         GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
           secretKeyRef: { name: grafana, key: oidc-client-secret }