diff --git a/README.md b/README.md
index 794665c..213ced0 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,15 @@ apps/<service>/
 
 `homelab-app.yaml` watches `apps/*/application.yaml` (recurse) only.
 
+**Sync policy differs from `cluster-platform` on purpose:** only the root
+`homelab` Application is automated (`prune: true`, `selfHeal: true`) — it
+picks up new/changed `apps/*/application.yaml` files automatically. Each
+per-service Application (`ignis`, and any future one) has **no**
+`syncPolicy.automated` — new services or config changes sit `OutOfSync` in
+ArgoCD until manually synced (UI "Sync" button or `argocd app sync <name>`).
+These are personal services, not cluster infra — a manual gate before an
+update actually rolls out is worth it here.
+
 ## Bootstrap
 
 ```bash
diff --git a/apps/ignis/application.yaml b/apps/ignis/application.yaml
index ca64cb8..937f02b 100644
--- a/apps/ignis/application.yaml
+++ b/apps/ignis/application.yaml
@@ -13,8 +13,5 @@ spec:
     server: https://kubernetes.default.svc
     namespace: ignis
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true