diff --git a/platform-gitops/helm-charts/base-service/templates/externalsecret-extra.yaml b/platform-gitops/helm-charts/base-service/templates/externalsecret-extra.yaml
index 35b3f5b2e..538bc37d6 100644
--- a/platform-gitops/helm-charts/base-service/templates/externalsecret-extra.yaml
+++ b/platform-gitops/helm-charts/base-service/templates/externalsecret-extra.yaml
@@ -6,6 +6,12 @@ metadata:
   name: {{ $name }}
   labels:
     {{- include "base-service.labels" $ | nindent 4 }}
+  {{- with $es.annotations }}
+  annotations:
+    {{- range $k, $v := . }}
+    {{ $k }}: {{ $v | quote }}
+    {{- end }}
+  {{- end }}
 spec:
   refreshInterval: {{ $es.refreshInterval | default "1h" }}
   secretStoreRef:
diff --git a/platform-gitops/services/labs/mctl-telegram/values.yaml b/platform-gitops/services/labs/mctl-telegram/values.yaml
index e561d72b3..658df70e7 100644
--- a/platform-gitops/services/labs/mctl-telegram/values.yaml
+++ b/platform-gitops/services/labs/mctl-telegram/values.yaml
@@ -91,6 +91,12 @@ extraExternalSecrets:
   labs-mctl-telegram-oauth:
     refreshInterval: 1h
     targetSecret: labs-mctl-telegram-oauth
+    # Force ArgoCD client-side apply for this ExternalSecret. ArgoCD v3.3.8 with
+    # ServerSideApply + serverSideDiff fails to apply ExternalSecrets with
+    # "metadata.managedFields must be nil"; client-side apply bypasses that path.
+    # Remove once the platform-wide ArgoCD SSA bug is fixed (see tracking issue).
+    annotations:
+      argocd.argoproj.io/sync-options: ServerSideApply=false
     data:
       # Dedicated mctl-telegram JWT signing key. Previously OAUTH_JWT_SECRET was
       # sourced from mctl-api's shared secret (secret/data/platform/mctl-api/oauth),