diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index cddd7d1..a38e948 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -17,8 +17,7 @@ OpenBao 路径：
 
 - `kv/k8s/nats.ci_producer_password`：已有 NATS producer 密码。
 - `kv/k8s/nats.ci_worker_password`：已有 NATS worker 密码。
-- `kv/k8s/microvm-runner.webhook_secret`：Gitea webhook HMAC secret；这是已有 Bao
-  路径，资源重命名不迁移 secret 数据。
+- `kv/k8s/dynamic-runner.webhook_secret`：Gitea webhook HMAC secret。
 - `kv/k8s/gitea-runner.token`：现有 instance runner registration token。
 
 首期 controller 与 runner 镜像由 laptop 本机构建后导入 k3s containerd，作为 CI
diff --git a/platform/dynamic-runner/external-secret.yaml b/platform/dynamic-runner/external-secret.yaml
index f406cd5..7baa41d 100644
--- a/platform/dynamic-runner/external-secret.yaml
+++ b/platform/dynamic-runner/external-secret.yaml
@@ -22,7 +22,7 @@ spec:
         property: ci_worker_password
     - secretKey: webhook-secret
       remoteRef:
-        key: k8s/microvm-runner
+        key: k8s/dynamic-runner
         property: webhook_secret
     - secretKey: token
       remoteRef: