diff --git a/infra/deploy/RUNBOOK-vps1-vps2-cutover.md b/infra/deploy/RUNBOOK-vps1-vps2-cutover.md
index d2acb3c..72934a5 100644
--- a/infra/deploy/RUNBOOK-vps1-vps2-cutover.md
+++ b/infra/deploy/RUNBOOK-vps1-vps2-cutover.md
@@ -49,6 +49,17 @@ or 8 is done wrong, which is what the verification lines are for.
 
       Keep the old `SSH_*` / `PROD_SSH_*` secrets until step 11 — they are the
       rollback path, and deleting them early strands you.
+
+      **Create these BEFORE merging.** `infra-sync.yml` fires on any push to
+      `dev` or `main` touching `infra/**`, and this change touches a great deal
+      of it. Without the new secrets those jobs SSH to an empty host and fail;
+      `sync-beta` additionally targets `/opt/thermograph-beta`, which does not
+      exist until step 1. Nothing is damaged either way — the jobs only fetch
+      and render — but you will get a red run and a misleading alert.
+
+      The app `Deploy` workflow does **not** fire on this merge: it is
+      path-filtered to `backend/**` and `frontend/**`, and this change touches
+      neither.
 - [ ] **Take a fresh prod backup and confirm it landed**, rather than trusting
       the schedule: