diff --git a/argocd/manifests/devpi/external-secret.yaml b/argocd/manifests/devpi/external-secret.yaml
index 8340ad0..1f591c1 100644
--- a/argocd/manifests/devpi/external-secret.yaml
+++ b/argocd/manifests/devpi/external-secret.yaml
@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: devpi-root
-    creationPolicy: Owner
+    creationPolicy: Merge  # Merge into existing secret for safe migration
   data:
   - secretKey: password
     remoteRef: