diff --git a/overrides/values-snp-vcek.yaml b/overrides/values-snp-vcek.yaml
new file mode 100644
index 00000000..48507b83
--- /dev/null
+++ b/overrides/values-snp-vcek.yaml
@@ -0,0 +1,9 @@
+# Generated by: make snp-gen-overrides
+#
+# PLACEHOLDER — committed with an empty vcekSecrets list so the trustee app's
+# extraValueFiles reference (values-baremetal.yaml) always resolves on a
+# fresh checkout.
+kbs:
+  snp:
+    enabled: true
+    vcekSecrets: []
diff --git a/overrides/values-trustee.yaml b/overrides/values-trustee.yaml
index 2c110c4e..a8f1459b 100644
--- a/overrides/values-trustee.yaml
+++ b/overrides/values-trustee.yaml
@@ -10,4 +10,4 @@ kbs:
     - name: "kbsres1"
       key: "secret/data/hub/kbsres1"
     - name: "passphrase"
-      key: "secret/data/hub/passphrase"
\ No newline at end of file
+      key: "secret/data/hub/passphrase"
diff --git a/scripts/gen-snp-vcek-overrides.sh b/scripts/gen-snp-vcek-overrides.sh
index b3675d17..3d51af6f 100755
--- a/scripts/gen-snp-vcek-overrides.sh
+++ b/scripts/gen-snp-vcek-overrides.sh
@@ -5,6 +5,11 @@ set -euo pipefail
 # Requires: ~/.coco-pattern/snp-vcek/<hwid>/vcek.der from download step.
 # Output: overrides/values-snp-vcek.yaml (chart values)
 #         stdout: values-secret.yaml entries to add
+#
+# kbs.snp.enabled is set separately in overrides/values-hw-amd-snp.yaml — this
+# script only owns overrides/values-snp-vcek.yaml (kbs.snp.vcekSecrets), which
+# is merged with the rest of the trustee overrides natively by Helm via the
+# trustee application's extraValueFiles list in values-baremetal.yaml.
 
 VCEKDIR="${HOME}/.coco-pattern/snp-vcek"
 OVERRIDE_FILE="overrides/values-snp-vcek.yaml"
diff --git a/values-baremetal.yaml b/values-baremetal.yaml
index f2c5ccf2..4eafaab2 100644
--- a/values-baremetal.yaml
+++ b/values-baremetal.yaml
@@ -197,6 +197,7 @@ clusterGroup:
         argocd.argoproj.io/sync-wave: "20"
       extraValueFiles:
         - '/overrides/values-trustee.yaml'
+        - '/overrides/values-snp-vcek.yaml'
       overrides:
         # Enable attestation-gated secret delivery via KBS
         - name: global.coco.secured