diff --git a/harnesses/contexts/gitea-admin/v1/harness.yaml b/harnesses/contexts/gitea-admin/v1/harness.yaml
index a449dfa..5135b23 100644
--- a/harnesses/contexts/gitea-admin/v1/harness.yaml
+++ b/harnesses/contexts/gitea-admin/v1/harness.yaml
@@ -19,7 +19,7 @@ ssh_hosts:
 secrets_required:
   # ESO-managed gitea-admin token (M22 Phase 9)
   - name: gitea-admin
-    account_ref: "gitea-admin"
+    account_ref: "admin.space:platform"
     mount_path: /run/agent/secrets/gitea-admin
     mode: "0400"
   # Legacy SSH key (file-based, already delivered as mount)
diff --git a/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml b/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml
index dae5536..20e8959 100644
--- a/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml
+++ b/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml
@@ -20,6 +20,6 @@ scripts:
 
 secrets_required:
   - name: gitea-ssh-accelerators
-    account_ref: "gitea-ssh-accelerators"
+    account_ref: "accelerators.space:platform"
     mount_path: /run/agent/secrets/gitea-ssh-accelerators
     mode: "0400"
diff --git a/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml b/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml
index 186a129..d10a104 100644
--- a/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml
+++ b/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml
@@ -20,6 +20,6 @@ scripts:
 
 secrets_required:
   - name: gitea-ssh-homelab
-    account_ref: "gitea-ssh-homelab"
+    account_ref: "homelab.space:platform"
     mount_path: /run/agent/secrets/gitea-ssh-homelab
     mode: "0400"
\ No newline at end of file
diff --git a/harnesses/contexts/gitea-ssh/v1/harness.yaml b/harnesses/contexts/gitea-ssh/v1/harness.yaml
index 44a4930..e05b647 100644
--- a/harnesses/contexts/gitea-ssh/v1/harness.yaml
+++ b/harnesses/contexts/gitea-ssh/v1/harness.yaml
@@ -20,6 +20,6 @@ scripts:
 
 secrets_required:
   - name: gitea-ssh
-    account_ref: "gitea-ssh"
+    account_ref: "ai_enablement.space:platform"
     mount_path: /run/agent/secrets/gitea-ssh
     mode: "0400"