diff --git a/manifest/overlays/production/secrets/kustomization.yaml b/manifest/overlays/production/secrets/kustomization.yaml
index 9af48f7..58b1b10 100644
--- a/manifest/overlays/production/secrets/kustomization.yaml
+++ b/manifest/overlays/production/secrets/kustomization.yaml
@@ -3,5 +3,5 @@ kind: Kustomization
 
 namespace: toolhive-system
 
-# resources:
-#   - state-docs-vmcp-secret.sealed.secret.yaml
+resources:
+  - public-mcp-secret.sealed.secret.yaml
diff --git a/manifest/overlays/production/secrets/public-mcp-secret.sealed.secret.yaml b/manifest/overlays/production/secrets/public-mcp-secret.sealed.secret.yaml
new file mode 100644
index 0000000..a7765a7
--- /dev/null
+++ b/manifest/overlays/production/secrets/public-mcp-secret.sealed.secret.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: "true"
+  name: public-mcp-secret
+  namespace: keycloak
+spec:
+  encryptedData:
+    client-id: AgANqLN6opyrUHiqVaUKvHwUr4chY38qb03WxUzXWll6SDh7bRvHcZ3wAMHfsmigEz2cSWVMWg0VmEcP16r6gcEiYGQ2/Ol182oXbtI/bWad/3rFFzMlLrKie8H9oGS/LgyRyhEiQ2hDzsdAJWARdHrRhbpFvJ1QeUJtcIBGKy8CcjTm8YfW7u/IqNyo0X+NIK2vImO9UdrmzIIDwQav0e30dRkmtbL5lamR563Qa1k4alEdOTF/E2fe6OVxaIqjpbzHnjmbKRA1ymhYGOasm8hTUeE/IVicAZNeQAg0ps31PSHpwjnEzyDZ1k7p5Dvc4+RhNXhOmONnI38/EbTA0dXra2ZeRxdcmErGrN2KrVZmlxyBK3462z8yWbiGU4esAdHJAdAjBkD+sDP2jYIsy7wvzArYM/hbFqDBrLs9vf29bYyUfRoRo/0BS+iO06zBjr0ssUT95FBrs1RLXDJUaomFkylz32L+jLfalKc4N1xeIwA76VOk4m3lVllmZP0YFC/mifHJ6qzuOgJqBw8fTkYhASiwyfsbbk3c8f4VlHqvXPKhJKkJvaUMMve59XpKuVX8O3phW2nJG4hl86OVkfOQRIZgPqn6t5UiHyJCPv6JoxAITs40thG06QUn263MTyZyaNGw9/PPVmSO/O5N2DIElWl75FpAEg3fqsljJiq2NGVQWLmT3C7tdyUwDEuu0r91cQmfUY7EehBD
+    client-secret: AgCCe5CH8xoDedXE9iM4GGEw/K7LhdXzH3lPynjlJ85OdMLuM6yYkaN37xF9FbdwhkQQnX3pjM08ILjEnpWtIx8zNmzTl+U90sSo85YqbSyZcNK7uy3oCTaRB6sdtPmdcDWEjtUcvv7+2WZcnAH8IfpT7wpesrjkO7uND0ZFX2bqhR26goq40gSiNahfCLp5QkZlsnTb6r6uw2N0utOLFDp3m233Nh268kxamlvr8E1IYDZFBC8KDIz9rfKvuMNBV6CA++FDeYybS1WNkgK3hQ+tGRVy5L7zB6x06zKzh4UIBn1t9sEga1x2ZH2Szgcb6EgBXmQ3rFaJ7O52dUltLV4GHX4uqRmjj+aZFQQuaJuvgp1Dc0rhFFwKveH5R0VcEarSDHeRlQmPiszKTsk8tgfCw8U64uoe6ACPq0isWVYBvUxttm/nB3MNSEl3TOquw9UtsiV1CaqC5LpI4qO1EatpARF57uqxw1Ewl8e8WrcBQ3WlI+7kjsJ2jHODx8sTlByqW7PZeJB4pk8sIq3NXA4VK/7f+852itxE0R7S67nZ4xFi75V6omyaEcniDVaPzxoC6EiFsPrUj8QpA+eRlKZRFTS4fmQRUkKVGYEnSWxDTkM1ot5dPx1MkA6MsEwq7wiuZwIbXeLK9Z3NqqsJ5LyTwidXhim5vf4iMHqH6Fj9ZL0RZTjMqfLXSjDD+Tu9qwMnXfkZx6EMsOLKc5uz73lP2VpGoUyq9ndqHsEbqYjbHQ==
+  template:
+    metadata:
+      annotations:
+        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: keycloak, toolhive-system
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      name: public-mcp-secret
+      namespace: keycloak
diff --git a/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml b/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
index e5e7a3d..d48a0b0 100644
--- a/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
+++ b/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
@@ -13,12 +13,6 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - kind: Rule
-      match: Host(`mcp.ngorse.com`)
-      services:
-        - name: vmcp-full-vmcp
-          namespace: toolhive-system
-          port: 4483
     - kind: Rule
       match: Host(`full-vmcp.olb42.com`)
       services:
diff --git a/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml b/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
index 575b464..2434e14 100644
--- a/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
+++ b/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
@@ -12,6 +12,12 @@ spec:
   entryPoints:
     - websecure
   routes:
+    - kind: Rule
+      match: Host(`mcp.ngorse.com`)
+      services:
+        - name: vmcp-full-vmcp
+          namespace: toolhive-system
+          port: 4483
     - kind: Rule
       match: Host(`full-vmcp.ngorse.com`)
       services: