diff --git a/deploy/external-secret.yaml b/deploy/external-secret.yaml
new file mode 100644
index 0000000..eb81e21
--- /dev/null
+++ b/deploy/external-secret.yaml
@@ -0,0 +1,43 @@
+# Materializes the provider-upjet-github credentials Secret from OpenBao.
+# Tenant-owned (applied by the github-config app's own ServiceAccount) and reads
+# through the platform-provisioned NAMESPACED SecretStore `openbao` — NOT the
+# shared cluster store — whose dedicated `github-config` Vault role is scoped to
+# secret/data/infrastructure/github/* only. namespace is omitted on purpose: the
+# platform tenant Kustomization injects it via targetNamespace (= github-config).
+#
+# The provider expects ONE JSON document ({"app_auth":[…],"owner":…}) whose
+# pem_file value carries \n-escaped newlines — the template builds it from the
+# three plain keys (toJson does the escaping), so the PEM lives in OpenBao as a
+# normal multiline string. The values are placeholders until the maintainer
+# overwrites secret/infrastructure/github/app in OpenBao (see the platform
+# docs/github-management.md).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: github-app-credentials
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: openbao
+    kind: SecretStore
+  target:
+    name: github-app-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        credentials: '{"app_auth":[{"id":"{{ .app_id }}","installation_id":"{{ .installation_id }}","pem_file":{{ .pem | toJson }}}],"owner":"devantler-tech"}'
+  data:
+    - secretKey: app_id
+      remoteRef:
+        key: infrastructure/github/app
+        property: app_id
+    - secretKey: installation_id
+      remoteRef:
+        key: infrastructure/github/app
+        property: installation_id
+    - secretKey: pem
+      remoteRef:
+        key: infrastructure/github/app
+        property: pem
diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml
index 51ba1ac..b9512a6 100644
--- a/deploy/kustomization.yaml
+++ b/deploy/kustomization.yaml
@@ -7,4 +7,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  # Tenant-owned auth wiring: the namespaced ProviderConfig + the GitHub App
+  # credential ExternalSecret (read via the platform-provisioned namespaced
+  # SecretStore). See the platform repo's docs/github-management.md.
+  - external-secret.yaml
+  - provider-config.yaml
   - repositories/
diff --git a/deploy/provider-config.yaml b/deploy/provider-config.yaml
new file mode 100644
index 0000000..3a28cfd
--- /dev/null
+++ b/deploy/provider-config.yaml
@@ -0,0 +1,18 @@
+# Namespaced ProviderConfig (Crossplane v2): authenticates provider-upjet-github
+# against the devantler-tech org as a GitHub App. Tenant-owned (applied by the
+# github-config app's ServiceAccount). It is referenced by the namespaced
+# Repository/… managed resources in this same namespace. The credentials Secret
+# is local (same namespace), materialized by external-secret.yaml from OpenBao.
+# namespace is omitted on purpose — the platform tenant Kustomization injects it
+# via targetNamespace (= github-config). The github.m.upbound.io CRD is installed
+# by the provider package (platform infrastructure layer).
+apiVersion: github.m.upbound.io/v1beta1
+kind: ProviderConfig
+metadata:
+  name: default
+spec:
+  credentials:
+    source: Secret
+    secretRef:
+      name: github-app-credentials
+      key: credentials