diff --git a/clusters/oci-lab/apps/external-secrets/manifests/clustersecretstore.yaml b/clusters/oci-lab/apps/external-secrets/manifests/clustersecretstore.yaml
index c551f3c..6a89036 100644
--- a/clusters/oci-lab/apps/external-secrets/manifests/clustersecretstore.yaml
+++ b/clusters/oci-lab/apps/external-secrets/manifests/clustersecretstore.yaml
@@ -9,8 +9,10 @@ spec:
     - namespaces: ["argocd", "harbor", "oci-pivot-system", "github-runners", "monitoring", "tailscale"]
   provider:
     bitwardensecretsmanager:
-      apiURL: https://api.bitwarden.com
-      identityURL: https://identity.bitwarden.com
+      # A trailing dot forces an absolute DNS lookup. OCI CoreDNS search
+      # expansion otherwise can return an empty NOERROR result as an SDK 400.
+      apiURL: https://api.bitwarden.com.
+      identityURL: https://identity.bitwarden.com.
       auth:
         secretRef:
           credentials:
diff --git a/clusters/oci-lab/apps/external-secrets/values.yaml b/clusters/oci-lab/apps/external-secrets/values.yaml
index 1210a31..ec23767 100644
--- a/clusters/oci-lab/apps/external-secrets/values.yaml
+++ b/clusters/oci-lab/apps/external-secrets/values.yaml
@@ -1,10 +1,5 @@
 bitwarden-sdk-server:
   enabled: true
-  # v0.7.0 updates the Bitwarden SDK implementation; v0.6.0 consistently
-  # received HTTP 400 from Bitwarden Identity despite a byte-identical valid
-  # machine-account token.
-  image:
-    tag: v0.7.0
 
 serviceMonitor:
   enabled: false