diff --git a/stacks/forgejo/cleanup.tf b/stacks/forgejo/cleanup.tf
index 6b180089..add332d3 100644
--- a/stacks/forgejo/cleanup.tf
+++ b/stacks/forgejo/cleanup.tf
@@ -35,7 +35,10 @@ resource "kubernetes_secret" "forgejo_cleanup_token" {
   }
   type = "Opaque"
   data = {
-    FORGEJO_TOKEN = data.vault_kv_secret_v2.forgejo_viktor.data["forgejo_cleanup_token"]
+    # try() so the apply succeeds before the Vault key is populated during
+    # Phase 0 bootstrap (see docs/runbooks/forgejo-registry-setup.md). Empty
+    # token causes the cleanup CronJob to fail visibly — that's intended.
+    FORGEJO_TOKEN = try(data.vault_kv_secret_v2.forgejo_viktor.data["forgejo_cleanup_token"], "")
   }
 }
 
diff --git a/stacks/kyverno/modules/kyverno/registry-credentials.tf b/stacks/kyverno/modules/kyverno/registry-credentials.tf
index 6d55f005..18949cad 100644
--- a/stacks/kyverno/modules/kyverno/registry-credentials.tf
+++ b/stacks/kyverno/modules/kyverno/registry-credentials.tf
@@ -32,8 +32,11 @@ resource "kubernetes_secret" "registry_credentials" {
         # Forgejo OCI registry — read-only PAT for the cluster-puller service
         # account user. Pushes go through ci-pusher (separate PAT in Vault
         # secret/ci/global, surfaced to Woodpecker).
+        # try() lets the apply succeed before the Vault key is populated
+        # during Phase 0 bootstrap (see docs/runbooks/forgejo-registry-setup.md).
+        # The cluster has no consumers yet — broken creds are visible but harmless.
         "forgejo.viktorbarzin.me" = {
-          auth = base64encode("cluster-puller:${data.vault_kv_secret_v2.viktor.data["forgejo_pull_token"]}")
+          auth = base64encode("cluster-puller:${try(data.vault_kv_secret_v2.viktor.data["forgejo_pull_token"], "")}")
         }
       }
     })
diff --git a/stacks/monitoring/main.tf b/stacks/monitoring/main.tf
index b222e226..3951e4e5 100644
--- a/stacks/monitoring/main.tf
+++ b/stacks/monitoring/main.tf
@@ -33,6 +33,10 @@ module "monitoring" {
   kube_config_path              = var.kube_config_path
   registry_user                 = data.vault_kv_secret_v2.viktor.data["registry_user"]
   registry_password             = data.vault_kv_secret_v2.viktor.data["registry_password"]
-  forgejo_pull_token            = data.vault_kv_secret_v2.viktor.data["forgejo_pull_token"]
-  tier                          = local.tiers.cluster
+  # try() so apply succeeds before the Vault key is populated during Phase 0
+  # bootstrap (see docs/runbooks/forgejo-registry-setup.md). Empty token =
+  # probe will report an auth failure and fire RegistryCatalogInaccessible —
+  # that's the intended visible-broken state until the PAT is created.
+  forgejo_pull_token = try(data.vault_kv_secret_v2.viktor.data["forgejo_pull_token"], "")
+  tier               = local.tiers.cluster
 }