diff --git a/platform/scaleway/external-secrets-store.yml b/platform/scaleway/external-secrets-store.yml
new file mode 100644
index 0000000..d4dd322
--- /dev/null
+++ b/platform/scaleway/external-secrets-store.yml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets-store
+  namespace: argocd
+  annotations:
+    # Wave 1: applied after the operator + CRDs (external-secrets, wave 0) so the
+    # ClusterSecretStore CRD it relies on already exists.
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+
+  source:
+    repoURL: https://github.com/IntegratedDynamic/gitops.git
+    targetRevision: main
+    path: platform/scaleway/external-secrets-store
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/platform/scaleway/external-secrets-store/cluster-secret-store.yaml b/platform/scaleway/external-secrets-store/cluster-secret-store.yaml
new file mode 100644
index 0000000..2ad9cf4
--- /dev/null
+++ b/platform/scaleway/external-secrets-store/cluster-secret-store.yaml
@@ -0,0 +1,26 @@
+# Cluster-wide store: any namespace's ExternalSecret can pull from Infisical
+# through this. Auth is the universal-auth credential seeded out-of-band by
+# Terraform (02-cluster/scaleway/external-secrets.tf) into the secret below —
+# the one secret ESO can't source from itself.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: infisical
+spec:
+  provider:
+    infisical:
+      hostAPI: https://app.infisical.com
+      auth:
+        universalAuthCredentials:
+          clientId:
+            name: infisical-universal-auth
+            namespace: external-secrets
+            key: clientId
+          clientSecret:
+            name: infisical-universal-auth
+            namespace: external-secrets
+            key: clientSecret
+      secretsScope:
+        projectSlug: platform-p-qc1
+        environmentSlug: staging
+        secretsPath: /
diff --git a/platform/scaleway/external-secrets.yml b/platform/scaleway/external-secrets.yml
new file mode 100644
index 0000000..2ee8074
--- /dev/null
+++ b/platform/scaleway/external-secrets.yml
@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+  annotations:
+    # Wave 0: the operator + CRDs must exist before the ClusterSecretStore
+    # (external-secrets-store, wave 1) that references those CRDs.
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: 2.6.0
+    helm:
+      values: |
+        installCRDs: true
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true