diff --git a/apps/nextcloud/manifests/redis-cr.yaml b/apps/nextcloud/manifests/redis-cr.yaml
index 6cb3653..5249d60 100644
--- a/apps/nextcloud/manifests/redis-cr.yaml
+++ b/apps/nextcloud/manifests/redis-cr.yaml
@@ -5,10 +5,12 @@
 # (apps/gitlab/manifests/redis-cluster.yaml), not this operator. This is the
 # first real consumer of it in the repo.
 #
-# NOTE: verify this CR against `kubectl explain redis.spec` (or the chart's
-# CRD source) for the redis-operator 0.15.0 actually deployed before first
-# apply - the ot-container-kit CRD schema has shifted across versions and
-# this wasn't checked against a live cluster.
+# Verified against the live CRD (redis.redis.redis.opstreelabs.in) 2026-08-17:
+# apiVersion is v1beta1, not v1beta2 as originally guessed here (blocked
+# ArgoCD from syncing the *entire* nextcloud Application - it validates all
+# resource types up front, so one unknown apiVersion blocks everything, not
+# just this resource). redisSecret also belongs nested under
+# kubernetesConfig, not top-level.
 apiVersion: generators.external-secrets.io/v1alpha1
 kind: Password
 metadata:
@@ -41,7 +43,7 @@ spec:
           kind: Password
           name: nextcloud-redis-password
 ---
-apiVersion: redis.redis.opstreelabs.in/v1beta2
+apiVersion: redis.redis.opstreelabs.in/v1beta1
 kind: Redis
 metadata:
   name: redis-nextcloud
@@ -57,11 +59,13 @@ spec:
       limits:
         cpu: 250m
         memory: 256Mi
+    redisSecret:
+      name: redis-nextcloud-secret
+      key: password
   redisExporter:
+    # image is required by the CRD schema even when enabled: false
     enabled: false
-  redisSecret:
-    name: redis-nextcloud-secret
-    key: password
+    image: quay.io/opstree/redis-exporter:v1.44.0
   storage:
     volumeClaimTemplate:
       spec: