diff --git a/infra/webhook/hooks.yaml b/infra/webhook/hooks.yaml
index 367dec85..7b426202 100644
--- a/infra/webhook/hooks.yaml
+++ b/infra/webhook/hooks.yaml
@@ -8,10 +8,11 @@
   trigger-rule:
     and:
       - match:
+          # Secret injected at deploy time from k8s secret webhook-secret via
+          # the cluster-side ConfigMap render (see infra/webhook/deployment.yaml).
+          # The rendered value is NOT committed to git.
           type: payload-hmac-sha256
-          secret:
-            source: env
-            name: WEBHOOK_SECRET
+          secret: "__WEBHOOK_SECRET__"
           parameter:
             source: header
             name: X-Hub-Signature-256
@@ -21,3 +22,4 @@
           parameter:
             source: payload
             name: ref
+