diff --git a/gh-protections.tf b/gh-protections.tf
index 29885c1..54ea415 100644
--- a/gh-protections.tf
+++ b/gh-protections.tf
@@ -25,5 +25,14 @@ resource "github_branch_protection" "protections" {
       "${var.github_owner}/${github_team.admins.slug}"
     ]
   }
-  depends_on = [github_repository.repositories, github_team.admins, github_team_repository.admins]
+  # Seed centrally managed files before protecting a newly added repository's
+  # main branch. Without this ordering, GitHub can reject the file commits as
+  # soon as the required-check rule is created in the same apply.
+  depends_on = [
+    github_repository.repositories,
+    github_repository_file.dependabot,
+    github_repository_file.dependabot_notify,
+    github_team.admins,
+    github_team_repository.admins,
+  ]
 }
diff --git a/main.tf b/main.tf
index 6cba6df..083afb1 100644
--- a/main.tf
+++ b/main.tf
@@ -118,6 +118,11 @@ locals {
       value        = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"]
       repositories = local.active_github_repositories
     }
+    "chart_updater_github_app_private_key" = {
+      name         = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY"
+      value        = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"]
+      repositories = ["charts"]
+    }
     "ssh_private_key" = {
       name  = "SSH_PRIVATE_KEY"
       value = data.sops_file.secret_vars.data["ssh_private_key"]
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index afccad5..597850b 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -21,13 +21,14 @@ www_aws_secret_access_key: ENC[AES256_GCM,data:x7YarHj9pKPiYHM04xkaU+fACjoOmM7ea
 cloudflare_zone_id: ENC[AES256_GCM,data:6RjS806r2iMX9dfWBJeLIG54jRu3DhylNP7QOmrOVWc=,iv:picCNDWPduEMzqcm3gh7oRaGEs+4n2E/P91EGC/3iDs=,tag:9G/KG68JLu/rxI+fLpQQ7Q==,type:str]
 cloudflare_api_token: ENC[AES256_GCM,data:z5WDjwxFZ7VaufG17WciwbbOVQlaZP+OSGOkRCTJQJAPxZCv8pHc6Q==,iv:jiUky+4sIka3Kkw4JcteY2eoj8uzSwsMAREamseJ/Vo=,tag:ChGagBsNZKUVka6rlcB/FQ==,type:str]
 grafana_alerts_token: ENC[AES256_GCM,data:DHykbs4ifLhkmbrh9DdBO0oyjEGCjdxoaWa6juRyWQIWbtNkedYgWQ8LorZ6HQ==,iv:/dvVgkKmSp5sY/UlH+mPpF5v7HRDjgG1ok3tAW81niY=,tag:UaZyqVrWQW997/6jxqjD/A==,type:str]
+chart_updater_github_app_private_key: ENC[AES256_GCM,data:CV7MpqKba+ULKxRlgXhTBN20m1jFrxcqDWq/QSi6/UbRrYqNwn0yL/1D2NMNDnbsOT/YH8dvr2IEGsd+2nl9x7Rc5RCjd6diviiXUCXt+WYnfjcRpruJ9JhfLnjRY0EnOrmM7aGR6DYk13SGg8sxTTAYt4TRHB8CV2hgAE9sEAztFwv0fizKXIPb9IVUOGNOO/bYquTbI3QnE1anubfZ3fb30iUOhWlt5WqtF37v+cy9CZQpUw9nYVloC/IoMfBp0ciBvkCaYKHt5WIlxbPY7+QxEIzZvR8+svdHGzlO4D2xZusN2Q2FRtYdeTNXUZU9jqqvjfOPRJUZgzZ5ivLVaMEQuhm8fuZfmYTd1rO6PKvEqIZeuYaFww/CnfQurYakSINsvgGzhzb317qdQuv9gicsn9W+tTS8imoBLBiExMDZaS35/R0QzJyDGk/ABtepy106VtyXtsTKbBnXmydcC7duqMHnzumgWSoGjHsjta+/YuF4xY3iGLb80BLzwP8af3vC3DmWuBOAZW+WvLe/dsEEa9xUO19riSj/sZfZIgB1zroVNAai0JgpKv3RkSUM+Tsd4SHrOYpfTC343FSQYUoSjMHBCt7CwRldds96TG9q3z76MIuYyC2buoZCGxk9bQxDKODSYpsHdp0iv80lXgnISaX5MgSWSKl/6cuugAz0DB/RP/Kf6kIJAdWf33sc5Ov/HNufb9ep5QhT0SQ6Q0vttXfAzZbz8+S8ymFUHP9AXQdfu2hJpNnUrjnGAlfSTBwPi8kCQ3vQTR2QQmJFLrRTNyfVCcn1DqZfPhSRf/FqXt8UDJe3W1sj9WE1THw45wOvxJwfbjw8bgEEtVMQFMJL00auszt5LQPXF+vd0rCegcKQBrnn+JHxrRtSaJMl2T+WCD6QO7tR+Z7ePnezwXGf7bT95/PBgEvMWWXzXCiPMQiw3ZeDfpfVHSikhb85hc6UA3Plkhisbf/2tN32UH0DirtvPrh3ztDYBQMARWfzUtvpqCy2iBLC61o5AaVhmy24qNgyBcG1AfNBMfHlS6/sboK95fcFsvSBGjyzex6UvCcwcxpUfE8u1ofPrqgPXhcA3WTtNgADW3MdLFie3TO9A9xTT9Bt8/kFR15A/EVp7WmEABvAEfCXTz5oxXw1aHTE8SQhxpinCoORqpV9wF8gNyI3PGcQTVu8VOOT/1OCqPHOpO62rDU4VLoK5RgHSq0UCxoX+SYHL1oh6XdiaE+S5NTcXjwABxvqczO/bmLn4BCfmmwTiF5rs0pVdKqaPrdF61rUSG5cC8i3z6W9/p3Oegu1G+Fcvx0OmEZ0gR4eCDvOyBFnM1ggaC2UWadHN5HfQXDoELQiJGy5xXqU01z3F3MSI+t93JmU0dVaXYSy+PtcnZvkylCGUKWxw04NBAd+n6e4fqY7BDRzakG9h7IPHv1Sil1s0yXev13IIzhpgUjC56KhpRrVVOGJtOUVtHF+VTWjMiLppDfOuC6aclTvg3ueRYp3V/Zhx3CrzPKX4V1YuoNWfhIdGEuyi6GRwKNV5vbOSsDHnt6IsRC50hwkCKRiYQeAglzFWY7UxTfDKAsYDK7R0RZgn1XfuoXUlOAyj2UL98M3mnhDHB+DIy9s7Q9Rv3phjDM/q8OeqDw/tQkBdwt2Wu5zdZ2URjpLe0b/DGjdafcEl/jgjKO4Rfw33kzIX6AAiv9IQksozXbWvDTK54x7Sf+Q911hJBbGRqYl0vX39iRUEB6Mj/D2K6IaQUA+yA78Y21cpum0rL4N7p459xIJJIjqIXMx1WhMQt7WnW2xtg2FXxjPI1zSjgxh6q4Kj/IWcOLvPNQu11lOyBQ2p7aqAYLp4BcIWurfjbwjBuHoZAi7r5kHsaj3+FXjcWw4X5PtNZRVnL73LvpFMuoRH5/ztSSCeI0pW79gR5f6x62hLnfZPzRHPVdCEG2Y8Jy4E5P8tdMRfBqcgnIH//MCd8re9aCgL+xV8HSM8tW+hv3okYFDKJ1eWBti/ZtRbMRmHeolFXMFG+mqGLD1XLn4nCEyOKuGNIbDRlMDZEx7CIopB4JhNXAYtSTM8hAS49JGvGhXatnv3Qtyj3Sp66Ein79G+3cGt4EHrTiEV0Qy6/SkViEUPEv8bL17CvZvKClDaPvDbkZWMfUJhRYgeOIF90c8aWKb2b0L7q0QKn9l9fGLcu8v685Z3FDB+xlJXq2gYmLiijtc5i85uN4MnK1NypeyBpEqAVg=,iv:rHIlw8HFt1kfB7QOquldanTFxyBl0WqQjk2bcz0uvjw=,tag:qQUrUAJsCeznddRNILw4VA==,type:str]
 sops:
     kms:
         - arn: arn:aws:kms:us-west-2:332355796717:key/0a45c0f6-71dc-4d54-ab33-9df4de1a9e91
           aws_profile: ""
           created_at: "2026-06-19T04:16:52Z"
           enc: AQICAHj1IggLFhM4nJnKEvmbEpk5E9RxZZoxpZYUW0taoyrz1AF/kg94UKFDzajWL4wI8KwkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmVOJEF56prSE5mcxAgEQgDt27+5rh3R0yvgpohI7YEEeZqxAJQiRdIomE22ohFcv2WGRfPXvbh43PlSwUAekZwmkLMM440d0Pu8zcA==
-    lastmodified: "2026-08-28T03:38:02Z"
-    mac: ENC[AES256_GCM,data:MUAyCFptZ98gScj5bb5Zj8gf0Z+SVOYQW1lIazb3bxvZE8A7v6GdEK5/uSZKLIyS56ONjtTzldQEqEdiWcu3cKgAQz7GZKhXrl4e34PFw8zEa9iUyE7RyOGso6pCdf+5TXuk3Md2rs8sFfh3ESnW5w3jO5EhSDtzGgGClvsTdXY=,iv:jD6ahHM6cyar4nMIYEMNsYPXLWjz0yMixwRRUx4UkKE=,tag:eFkSw7LmQISm7vdwHsoL+A==,type:str]
+    lastmodified: "2026-08-28T16:19:07Z"
+    mac: ENC[AES256_GCM,data:Yk3ybYzzstQKIcjJ4HbXX9f4/jKIEK2MFQBpWXOakxaq0ks4MUEenG6kReVSW3BVBxWUx7p1bMRZCKXdWqEgbPtnhre/Q2m6dEtcaUFz+jOIrGaPh+uY/fnNI4Y3Riop4uWt+CE26g2DBhz2hHpBslin1nrK8qe0FFe10RHwCzo=,iv:/eCJMebA31rSJ6UcA6ZvbNHZ557KsckK49mh4hx+KVg=,tag:5/ksHm5Qe/eV3UbznV7yrg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3