diff --git a/Chart.yaml b/Chart.yaml
index 14eab62..02c28bd 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -5,7 +5,7 @@ home: https://github.com/validatedpatterns/aap-config-chart.git
 keywords:
 - pattern
 name: aap-config
-version: 0.2.6
+version: 0.2.7
 dependencies:
 - name: vp-rbac
   version: '0.1.*'
diff --git a/README.md b/README.md
index 902574c..71841a8 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # aap-config
 
-![Version: 0.2.6](https://img.shields.io/badge/Version-0.2.6-informational?style=flat-square)
+![Version: 0.2.7](https://img.shields.io/badge/Version-0.2.7-informational?style=flat-square)
 
 A Helm chart to build and deploy secrets using external-secrets for ansible-edge-gitops
 
@@ -53,6 +53,12 @@ is unset or left at chart defaults; when `cac_*` is explicitly set, it wins over
 
 * v0.2.6: Track v3 of AGOF by default
 
+* v0.2.7: Reconfigure external secrets validation retries. Add configurable
+`validationJob.backoffLimit` (default 20) and reduce `validationJob.activeDeadlineSeconds`
+to 600 (10 min). Run the validation job as an Argo Sync hook at sync-wave 2 with
+`HookSucceeded,BeforeHookCreation` so ExternalSecrets apply in wave 1 before
+validation runs and each sync retry gets a fresh job without OutOfSync drift.
+
 ### Git authentication secret (`agof.gitAuthSecret`)
 
 When `agof_repo` or the config-as-code repo (`agof.cac_repo` / `agof.iac_repo`) is
@@ -304,7 +310,8 @@ secrets:
 | secretStore.name | string | `"vault-backend"` |  |
 | serviceAccountName | string | `"aap-config-sa"` |  |
 | serviceAccountNamespace | string | `"aap-config"` |  |
-| validationJob.activeDeadlineSeconds | int | `3600` |  |
+| validationJob.activeDeadlineSeconds | int | `600` |  |
+| validationJob.backoffLimit | int | `20` |  |
 | validationJob.disabled | bool | `false` |  |
 | vp-rbac.clusterRoles.view-routes.rules[0].apiGroups[0] | string | `"route.openshift.io"` |  |
 | vp-rbac.clusterRoles.view-routes.rules[0].resources[0] | string | `"routes"` |  |
diff --git a/README.md.gotmpl b/README.md.gotmpl
index 2988600..de07850 100644
--- a/README.md.gotmpl
+++ b/README.md.gotmpl
@@ -54,6 +54,12 @@ is unset or left at chart defaults; when `cac_*` is explicitly set, it wins over
 
 * v0.2.6: Track v3 of AGOF by default
 
+* v0.2.7: Reconfigure external secrets validation retries. Add configurable
+`validationJob.backoffLimit` (default 20) and reduce `validationJob.activeDeadlineSeconds`
+to 600 (10 min). Run the validation job as an Argo Sync hook at sync-wave 2 with
+`HookSucceeded,BeforeHookCreation` so ExternalSecrets apply in wave 1 before
+validation runs and each sync retry gets a fresh job without OutOfSync drift.
+
 ### Git authentication secret (`agof.gitAuthSecret`)
 
 When `agof_repo` or the config-as-code repo (`agof.cac_repo` / `agof.iac_repo`) is
diff --git a/templates/agof-config-bootstrap-job.yaml b/templates/agof-config-bootstrap-job.yaml
index e417a85..277aa5b 100644
--- a/templates/agof-config-bootstrap-job.yaml
+++ b/templates/agof-config-bootstrap-job.yaml
@@ -5,7 +5,7 @@ kind: Job
 metadata:
   name: agof-config-bootstrap-job
   annotations:
-    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/sync-wave: "3"
 spec:
   parallelism: 1
   completions: 1
diff --git a/templates/external-secrets-validation-job.yaml b/templates/external-secrets-validation-job.yaml
index 874530d..58bc48e 100644
--- a/templates/external-secrets-validation-job.yaml
+++ b/templates/external-secrets-validation-job.yaml
@@ -5,11 +5,13 @@ kind: Job
 metadata:
   name: external-secrets-validation-job
   annotations:
-    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
 spec:
   parallelism: 1
   completions: 1
-  backoffLimit: 3
+  backoffLimit: {{ $.Values.validationJob.backoffLimit }}
   activeDeadlineSeconds: {{ $.Values.validationJob.activeDeadlineSeconds }}
   template:
     spec:
diff --git a/values.yaml b/values.yaml
index 330562c..4900d2d 100644
--- a/values.yaml
+++ b/values.yaml
@@ -56,7 +56,8 @@ serviceAccountNamespace: aap-config
 # Validation job configuration
 validationJob:
   disabled: false
-  activeDeadlineSeconds: 3600
+  activeDeadlineSeconds: 600
+  backoffLimit: 20
 
 # RBAC configuration using vp-rbac subchart
 vp-rbac: