diff --git a/argocd/manifests/argocd/external-secret-repo-forge.yaml b/argocd/manifests/argocd/external-secret-repo-forge.yaml
index 1f96a43..dbb6724 100644
--- a/argocd/manifests/argocd/external-secret-repo-forge.yaml
+++ b/argocd/manifests/argocd/external-secret-repo-forge.yaml
@@ -2,8 +2,11 @@
 #
 # Replaces the manual op inject workflow from repo-forge-secret.yaml.tpl
 #
-# 1Password item: "argocd forge key" in blumeops vault
-# Field: "private key"
+# 1Password item: "argocd-forge-ssh-key" in blumeops vault (Secure Note)
+# Field: "private-key-openssh"
+#
+# Note: Uses a separate Secure Note item because 1Password Connect doesn't
+# support the ?ssh-format=openssh query parameter that the CLI uses.
 #
 # This is a repo-creds (credential template) that matches ALL repos under eblume/
 #
@@ -32,5 +35,5 @@ spec:
   data:
   - secretKey: privateKey
     remoteRef:
-      key: argocd forge key
-      property: private key
+      key: argocd-forge-ssh-key
+      property: private-key-openssh