diff --git a/k8s/helm/commonly/templates/secrets/api-keys.yaml b/k8s/helm/commonly/templates/secrets/api-keys.yaml
index 1cc841ea91..d21a277fe9 100644
--- a/k8s/helm/commonly/templates/secrets/api-keys.yaml
+++ b/k8s/helm/commonly/templates/secrets/api-keys.yaml
@@ -203,6 +203,11 @@ spec:
   - secretKey: slack-signing-secret
     remoteRef:
       key: {{ $keyPrefix }}slack-signing-secret
+  {{- end }}
+  {{- if or .Values.slack.oauth.enabled .Values.connectorSecrets.enabled }}
+  # Connector secret key ring (keyId:base64,...). Every hosted-MCP and Slack connection is
+  # encrypted with it, so it can't stay tied to Slack OAuth: staging (Slack off) had no ring and
+  # every hosted-MCP callback threw. Both remote keys must exist before enabling.
   - secretKey: connector-secret-keys
     remoteRef:
       key: {{ $keyPrefix }}connector-secret-keys
diff --git a/k8s/helm/commonly/values-staging.yaml b/k8s/helm/commonly/values-staging.yaml
index cc63ce16b1..f78998a139 100644
--- a/k8s/helm/commonly/values-staging.yaml
+++ b/k8s/helm/commonly/values-staging.yaml
@@ -205,3 +205,8 @@ mongodb:
       key: workload-tier
       operator: Equal
       value: spot
+
+# Staging-only connector key ring (commonly-staging-connector-secret-keys / -active-key in SM,
+# fresh keys, never prod's). Without it every hosted-MCP OAuth callback on staging threw.
+connectorSecrets:
+  enabled: true
diff --git a/k8s/helm/commonly/values.yaml b/k8s/helm/commonly/values.yaml
index 52640018e8..c1b0bf62e0 100644
--- a/k8s/helm/commonly/values.yaml
+++ b/k8s/helm/commonly/values.yaml
@@ -57,6 +57,11 @@ slack:
   oauth:
     enabled: false
 
+# Connector secret key ring in api-keys (connector-secret-keys + -active-key). Also mapped
+# whenever slack.oauth.enabled is on. Turn on for any instance that offers hosted-MCP connectors.
+connectorSecrets:
+  enabled: false
+
 # Google Calendar's hosted-MCP entry uses a pre-registered OAuth client
 # (backend/integrations/hostedMcp/googleCalendar.ts). The backend reads
 # GOOGLE_CALENDAR_CLIENT_ID / GOOGLE_CALENDAR_CLIENT_SECRET, the names