diff --git a/apps/recovery.yaml b/apps/recovery.yaml
deleted file mode 100644
index acac914..0000000
--- a/apps/recovery.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# TEMPORARY disaster-recovery application. This creates a short-lived
-# administrative ServiceAccount so a lost kubeconfig can be replaced through
-# the still-working Argo CD control plane. Remove this file and apps/recovery/
-# immediately after access is restored; the finalizer then deletes everything.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: credential-recovery
-  namespace: argocd
-  finalizers:
-    # Cascading deletion is essential here: it removes the temporary
-    # cluster-admin binding rather than leaving privileged access behind.
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  source:
-    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
-    targetRevision: main
-    path: apps/recovery
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: credential-recovery
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
diff --git a/apps/recovery/clusterrolebinding.yaml b/apps/recovery/clusterrolebinding.yaml
deleted file mode 100644
index 0179319..0000000
--- a/apps/recovery/clusterrolebinding.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-# TEMPORARY: this binding exists only long enough to replace the lost
-# administrator kubeconfig. The recovery Application's cascading finalizer
-# removes it when apps/recovery.yaml is deleted from Git.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: credential-recovery-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: credential-recovery
-    namespace: credential-recovery
diff --git a/apps/recovery/job.yaml b/apps/recovery/job.yaml
deleted file mode 100644
index 533caa3..0000000
--- a/apps/recovery/job.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
----
-# TEMPORARY: emit a one-hour ServiceAccount kubeconfig into this Job's logs.
-# Argo CD's authenticated log API lets the administrator capture it directly
-# into a mode-0600 local file without committing the credential to Git.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: emit-recovery-kubeconfig
-  namespace: credential-recovery
-spec:
-  backoffLimit: 0
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: credential-recovery
-    spec:
-      restartPolicy: Never
-      serviceAccountName: credential-recovery
-      containers:
-        - name: emit-kubeconfig
-          image: busybox:1.37.0
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-            - -eu
-            - -c
-            - |
-              serviceaccount_dir=/var/run/secrets/kubernetes.io/serviceaccount
-              ca_data="$(base64 "$serviceaccount_dir/ca.crt" | tr -d '\n')"
-              token="$(cat "$serviceaccount_dir/token")"
-              cat <<EOF
-              apiVersion: v1
-              kind: Config
-              clusters:
-                - name: gitops-starter
-                  cluster:
-                    server: https://10.10.10.210:6443
-                    certificate-authority-data: ${ca_data}
-              contexts:
-                - name: recovery-admin@gitops-starter
-                  context:
-                    cluster: gitops-starter
-                    user: recovery-admin
-              current-context: recovery-admin@gitops-starter
-              users:
-                - name: recovery-admin
-                  user:
-                    token: ${token}
-              EOF
-          resources:
-            requests:
-              cpu: 5m
-              memory: 8Mi
-            limits:
-              cpu: 50m
-              memory: 32Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 65534
-            seccompProfile:
-              type: RuntimeDefault
diff --git a/apps/recovery/serviceaccount.yaml b/apps/recovery/serviceaccount.yaml
deleted file mode 100644
index ac226c5..0000000
--- a/apps/recovery/serviceaccount.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: credential-recovery
-  namespace: credential-recovery