diff --git a/bootstrap/apps/envoy-gateway-config.yaml b/bootstrap/apps/envoy-gateway-config.yaml
index 18c5d88..3a50b45 100644
--- a/bootstrap/apps/envoy-gateway-config.yaml
+++ b/bootstrap/apps/envoy-gateway-config.yaml
@@ -14,9 +14,7 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - SkipDryRunOnMissingResource=true
diff --git a/bootstrap/apps/envoy-gateway.yaml b/bootstrap/apps/envoy-gateway.yaml
index dc8ed67..98ad100 100644
--- a/bootstrap/apps/envoy-gateway.yaml
+++ b/bootstrap/apps/envoy-gateway.yaml
@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/bootstrap/apps/metallb-config.yaml b/bootstrap/apps/metallb-config.yaml
index 35446c5..c060350 100644
--- a/bootstrap/apps/metallb-config.yaml
+++ b/bootstrap/apps/metallb-config.yaml
@@ -14,10 +14,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - SkipDryRunOnMissingResource=true
diff --git a/bootstrap/apps/metallb.yaml b/bootstrap/apps/metallb.yaml
index 4d5c51c..e5200b8 100644
--- a/bootstrap/apps/metallb.yaml
+++ b/bootstrap/apps/metallb.yaml
@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
   ignoreDifferences:
diff --git a/bootstrap/apps/nfs-provisioner.yaml b/bootstrap/apps/nfs-provisioner.yaml
index ff0a6bd..958e680 100644
--- a/bootstrap/apps/nfs-provisioner.yaml
+++ b/bootstrap/apps/nfs-provisioner.yaml
@@ -20,9 +20,7 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: nfs-provisioner
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true