diff --git a/stacks/calico/main.tf b/stacks/calico/main.tf
index afe21f43..4bb8b488 100644
--- a/stacks/calico/main.tf
+++ b/stacks/calico/main.tf
@@ -22,7 +22,9 @@ resource "kubernetes_namespace" "calico_system" {
     name = "calico-system"
     labels = {
       name = "calico-system"
-      "keel.sh/enrolled" = "true"
+# calico-system namespace is managed by tigera-operator — auto-update is
+      # incompatible (operator reverts DaemonSet image from its Installation CR).
+      # "keel.sh/enrolled" = "true"
     }
   }
   lifecycle {