diff --git a/config/hwlab-v03/secrets.yaml b/config/hwlab-v03/secrets.yaml
index 250c379c..a67d19d2 100644
--- a/config/hwlab-v03/secrets.yaml
+++ b/config/hwlab-v03/secrets.yaml
@@ -4,12 +4,12 @@ metadata:
   id: hwlab-v03-secret-plane
   owner: HWLAB
   spec: pikasTech/HWLAB#2234
-  boundary: D601/v0.3 only
+  boundary: D518/v0.3 only
 secretPlane:
   enabled: true
   issue: pikasTech/HWLAB#2234
   enabledOnNodes:
-    - D601
+    - D518
   valuesPrinted: false
   store:
     kind: ClusterSecretStore
@@ -19,7 +19,7 @@ secretPlane:
     - id: hwlab-secret-plane-smoke
       externalSecretName: hwlab-secret-plane-smoke
       targetSecretName: hwlab-secret-plane-smoke
-      purpose: Low-risk D601/v0.3 smoke secret for platform-infra secret-plane integration.
+      purpose: Low-risk D518/v0.3 smoke secret for platform-infra secret-plane integration.
       data:
         - targetKey: password
           remoteRef: hwlab-secret-plane/poc
diff --git a/scripts/gitops-render.mjs b/scripts/gitops-render.mjs
index a6e03e99..167d2a9a 100644
--- a/scripts/gitops-render.mjs
+++ b/scripts/gitops-render.mjs
@@ -5566,7 +5566,7 @@ function gitopsRootNodeId(gitopsRoot) {
 function runtimeSecretPlaneManifest({ config, namespace, labels, annotations }) {
   const store = config?.store;
   assert.ok(store && typeof store === "object" && !Array.isArray(store), "secretPlane.store must be an object");
-  assert.equal(store.kind, "ClusterSecretStore", "secretPlane.store.kind must be ClusterSecretStore for D601/v0.3");
+  assert.equal(store.kind, "ClusterSecretStore", "secretPlane.store.kind must be ClusterSecretStore for node-scoped v0.3");
   assert.ok(typeof store.name === "string" && store.name.trim(), "secretPlane.store.name must be set");
   const secrets = Array.isArray(config.secrets) ? config.secrets : [];
   assert.ok(secrets.length > 0, "secretPlane.secrets must not be empty");
diff --git a/scripts/gitops-render.test.ts b/scripts/gitops-render.test.ts
index a7adacd9..0a6e67e5 100644
--- a/scripts/gitops-render.test.ts
+++ b/scripts/gitops-render.test.ts
@@ -549,7 +549,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
       "scripts/run-bun.mjs",
       "scripts/gitops-render.mjs",
       "--lane", "v03",
-      "--node", "D601",
+      "--node", "D518",
       "--catalog-path", staleCatalogPath,
       "--image-tag-mode", "full",
       "--source-branch", "v0.3",
@@ -630,7 +630,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
       .flatMap((container) => container.env ?? [])
       .filter((entry) => entry.name === "HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID");
     assert.ok(agentRunNodeEnv.length > 0, "expected AgentRun provider id env to carry configured node id");
-    assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["D601"]);
+    assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["D518"]);
 
   } finally {
     await rm(outDir, { recursive: true, force: true });
@@ -638,7 +638,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
   }
 });
 
-test("v03 render skips D601 secret-plane smoke on D518 gitops root", async () => {
+test("v03 render includes D518 secret-plane smoke on D518 gitops root", async () => {
   const outDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-v03-d518-render-test-"));
   const scratchDir = path.join(".tmp", `gitops-render-v03-d518-${process.pid}-${Date.now()}`);
   const staleCatalogPath = path.join(scratchDir, "artifact-catalog.v03.json");
@@ -689,9 +689,17 @@ test("v03 render skips D601 secret-plane smoke on D518 gitops root", async () =>
     const generatedPaths = generatedFiles.map((filePath) => path.relative(outDir, filePath));
     assert.ok(generatedPaths.includes("runtime-v03/kustomization.yaml"));
     assert.ok(generatedPaths.includes("runtime-v03/workloads.yaml"));
-    assert.equal(generatedPaths.includes("runtime-v03/external-secrets.yaml"), false);
+    assert.equal(generatedPaths.includes("runtime-v03/external-secrets.yaml"), true);
     const kustomization = await readFile(path.join(outDir, "runtime-v03", "kustomization.yaml"), "utf8");
-    assert.doesNotMatch(kustomization, /external-secrets\.yaml/u);
+    assert.match(kustomization, /external-secrets\.yaml/u);
+    const externalSecretsJson = JSON.parse(await readFile(path.join(outDir, "runtime-v03", "external-secrets.yaml"), "utf8"));
+    const smokeExternalSecret = (externalSecretsJson.items ?? []).find((item) => item.kind === "ExternalSecret" && item.metadata?.name === "hwlab-secret-plane-smoke");
+    assert.ok(smokeExternalSecret, "expected D518 v03 secret-plane smoke ExternalSecret");
+    assert.equal(smokeExternalSecret.metadata?.namespace, "hwlab-v03");
+    assert.equal(smokeExternalSecret.spec?.secretStoreRef?.kind, "ClusterSecretStore");
+    assert.equal(smokeExternalSecret.spec?.secretStoreRef?.name, "hwlab-secret-plane-vault-cluster");
+    assert.equal(smokeExternalSecret.spec?.target?.name, "hwlab-secret-plane-smoke");
+    assert.deepEqual(smokeExternalSecret.spec?.data, [{ secretKey: "password", remoteRef: { key: "hwlab-secret-plane/poc", property: "password" } }]);
 
     const workloadsJson = JSON.parse(await readFile(path.join(outDir, "runtime-v03", "workloads.yaml"), "utf8"));
     const cloudApi = (workloadsJson.items ?? []).find((item) => item.kind === "Deployment" && item.metadata?.name === "hwlab-cloud-api");