diff --git a/README.md b/README.md
index c612fca..8cd8690 100644
--- a/README.md
+++ b/README.md
@@ -105,6 +105,23 @@ kubectl port-forward svc/argocd-server -n argocd 8080:443
 
 Open `https://localhost:8080` — login with `admin` and the password you chose.
 
+### 3.1 Bake the hash into values.yaml for self-management
+
+ArgoCD won't run `envsubst` when it self-manages — replace the placeholder with the real hash so future syncs work:
+
+```bash
+source .env
+sed -i "s|\$ARGOCD_ADMIN_PASSWORD_HASH|$ARGOCD_ADMIN_PASSWORD_HASH|" manifests/argocd/values.yaml
+```
+
+```bash
+git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
+```
+
+```bash
+git push origin main
+```
+
 ---
 
 ## Phase 4 — Create bootstrap app in ArgoCD UI
diff --git a/bootstrap/apps/argocd.yaml b/bootstrap/apps/argocd.yaml
new file mode 100644
index 0000000..531d785
--- /dev/null
+++ b/bootstrap/apps/argocd.yaml
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  project: default
+  sources:
+    - repoURL: https://argoproj.github.io/argo-helm
+      chart: argo-cd
+      targetRevision: "7.8.26"
+      helm:
+        valueFiles:
+          - $values/manifests/argocd/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true