diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 837e6ce..67a2d00 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -43,6 +43,12 @@ image:
 - Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
 - Use as prefix of YAML files the resource kind (e.g., `deployment.yaml` for `Deployment` resources). If there are multiple resources of the same kind, use a descriptive suffix (e.g., `deployment_metrics.yaml` for a `Deployment` related to metrics).
 - Short names like `pvc` for Persistent Volume Claims or `svc` for Services are not allowed in file names or key names.
+- Render `Secret` payloads as base64 `data` and never as `stringData`. The API server drops `stringData` and persists everything under `data`, so Helm's three-way merge cannot prune a key that was removed from the values — the stale key survives every upgrade. For example:
+
+```yaml
+data:
+  app.ini: {{ $config | b64enc }}
+```
 
 ### Unit Tests
 
@@ -52,6 +58,7 @@ image:
 - The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint.yaml`. Use `make yamllint` to run the linter.
 - The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
 - Each unit test must explicitly set a custom namespace and release name, rather than relying on defaults.
+- Assert `Secret` content via `data.*` with `decodeBase64: true` and add a `notExists` assertion for `stringData`.
 
 ### Commits & PRs