diff --git a/apps/grafana/README.md b/apps/grafana/README.md
new file mode 100644
index 0000000..3de0266
--- /dev/null
+++ b/apps/grafana/README.md
@@ -0,0 +1,11 @@
+# Grafana cluster deployment
+
+Argo CD owns the Grafana Helm release and the dashboard ConfigMaps in
+`resources/`. The selected upstream chart version is recorded once in
+`bootstrap/grafana.yaml`; change it there to upgrade.
+
+The existing `grafana` Secret supplies the admin credentials, while
+`grafana-postgres-secret` supplies database and OAuth credentials. They are
+referenced by name and must remain cluster-managed; do not add their data to
+this public repository. The prior Helm release record is retained for recovery
+and must not be upgraded or uninstalled after Argo adoption.
diff --git a/bootstrap/grafana.yaml b/bootstrap/grafana.yaml
index 79e664a..b33ed55 100644
--- a/bootstrap/grafana.yaml
+++ b/bootstrap/grafana.yaml
@@ -25,5 +25,5 @@ spec:
   syncPolicy:
     automated:
       enabled: true
-      prune: false
-      selfHeal: false
+      prune: true
+      selfHeal: true