diff --git a/bootstrap/platform/main.tf b/bootstrap/platform/main.tf
index 610ec27..efc9eb6 100644
--- a/bootstrap/platform/main.tf
+++ b/bootstrap/platform/main.tf
@@ -1301,6 +1301,11 @@ resource "null_resource" "argocd_private_repo" {
     secret_name     = var.argocd.repo_secret_name
     repo_url        = var.gitops_repo_url
     ssh_key_path    = var.gitops_ssh_key_path
+    # Force the keyscan + configmap/secret merge to re-run on EVERY apply.
+    # The GitOps SSH host key can rotate (Gitea container rebuilt, Debian host
+    # rekeyed) and the static triggers above would otherwise never change,
+    # silently leaving Argo CD with `knownhosts: key is unknown`.
+    scan_revision = timestamp()
   }
 
   provisioner "local-exec" {