diff --git a/services/harbor/hermes-agent-base-mirror-job.yaml b/services/harbor/hermes-agent-base-mirror-job.yaml
index 4c89ff38..a04b5ad5 100644
--- a/services/harbor/hermes-agent-base-mirror-job.yaml
+++ b/services/harbor/hermes-agent-base-mirror-job.yaml
@@ -26,6 +26,10 @@ spec:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/agent-pre-populate-only: "true"
+        # This Job has an app init container (ensure-project) that reads the
+        # injected secret, so Vault's init must run FIRST — otherwise it is
+        # appended after ensure-project and the secret file isn't written yet.
+        vault.hashicorp.com/agent-init-first: "true"
         vault.hashicorp.com/agent-run-as-user: "65532"
         vault.hashicorp.com/agent-run-as-group: "65532"
         vault.hashicorp.com/role: harbor-policy-bootstrap