diff --git a/manifests/gitea-runner/secrets.yaml b/manifests/gitea-runner/secrets.yaml
new file mode 100644
index 0000000..60c00ed
--- /dev/null
+++ b/manifests/gitea-runner/secrets.yaml
@@ -0,0 +1,16 @@
+# FIXME: This Secret is a placeholder only!
+# Greg must generate a runner registration token from the Gitea web UI
+# (Site Administration → Actions → Runners → Create Runner Token),
+# then store it in agenix and wire it up to populate this Secret.
+# The Secret should have key: token
+#
+# Until this Secret exists in the cluster, the gitea-runner HelmRelease
+# will fail to deploy.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-runner
+  namespace: gitea-runner
+stringData:
+  # FIXME: Replace with actual runner token (managed via agenix / external-secrets)
+  token: "REPLACE_ME_WITH_ACTUAL_TOKEN"