diff --git a/manifest/overlays/production/kustomization.yaml b/manifest/overlays/production/kustomization.yaml
index 05085c9..bfc9c6a 100644
--- a/manifest/overlays/production/kustomization.yaml
+++ b/manifest/overlays/production/kustomization.yaml
@@ -11,6 +11,7 @@ resources:
   - ingressroute.yaml
   - secrets/gitea-mcp-secret.sealed.secret.yaml
   - secrets/argocd-mcp-secret.sealed.secret.yaml
+  # TODO: add after sealing — secrets/state-docs-vmcp-secret.sealed.secret.yaml
   - mcp-tool-config-state-docs.yaml
   - mcp-tool-config-ops.yaml
   - mcp-tool-config-dev.yaml
diff --git a/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml b/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml
index 5c31c44..2ee87ab 100644
--- a/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml
+++ b/manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml
@@ -14,7 +14,13 @@ spec:
   embeddingServerRef:
     name: homelab-embedding
   incomingAuth:
-    type: anonymous
+    type: oidc
+    oidc:
+      issuerUrl: https://cloak.olb42.com/realms/home-lab
+      clientId: state-docs-vmcp
+      clientSecretRef:
+        name: state-docs-vmcp-secret
+        key: client-secret
   config:
     aggregation:
       conflictResolution: prefix