diff --git a/.claude/settings.json b/.claude/settings.json
index 80066d2..79f6490 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -12,7 +12,11 @@
       "Bash(export KUBECONFIG=.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig)",
       "Bash(kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=200)",
       "Bash(kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=5)",
-      "Bash(kubectl -n capi-operator-system logs deploy/cluster-api-operator --tail=300)"
+      "Bash(kubectl -n capi-operator-system logs deploy/cluster-api-operator --tail=300)",
+      "Bash(clusterctl version *)",
+      "Bash(KUBECONFIG=/Users/jan.novak/srv/go/cluster-autoscaler-with-capi/.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig kubectl get nodes)",
+      "Bash(clusterctl generate *)",
+      "Bash(ansible mgmt *)"
     ]
   }
 }
diff --git a/ansible/templates/capi-providers.yaml.j2 b/ansible/templates/capi-providers.yaml.j2
index 1a51b5d..fbaaeee 100644
--- a/ansible/templates/capi-providers.yaml.j2
+++ b/ansible/templates/capi-providers.yaml.j2
@@ -13,10 +13,12 @@ metadata:
   name: capmox-variables
   namespace: capmox-system
 type: Opaque
-stringData:
-  PROXMOX_URL: "{{ proxmox_url }}"
-  PROXMOX_TOKEN: "{{ proxmox_token_id }}"
-  PROXMOX_SECRET: "{{ proxmox_token_secret }}"
+# `data`, not `stringData`: stringData is never stored, so `kubectl apply` would report
+# "configured" on every run and break the playbook's changed=0.
+data:
+  PROXMOX_URL: {{ proxmox_url | b64encode }}
+  PROXMOX_TOKEN: {{ proxmox_token_id | b64encode }}
+  PROXMOX_SECRET: {{ proxmox_token_secret | b64encode }}
 {% for p in capi_providers %}
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
diff --git a/docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md b/docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md
index 7055d97..c1a3fc5 100644
--- a/docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md
+++ b/docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md
@@ -110,3 +110,28 @@ full playbook run re-applies it via the `inspector` task (`--apply-rbac`).
 
 **Worth noting:** the `.claude/settings.json` allowlist picked up four one-off entries approved
 during this check (`export KUBECONFIG=…`, three exact `kubectl … logs` commands).
+
+## Step 3 — Idempotency check (in progress)
+
+### Full run: `Apply provider manifests` always `changed` (2026-09-27 10:35 CEST)
+
+Owner's full `ansible-playbook mgmt.yml` runs kept reporting `changed` on this one task. Found
+with two read-only commands on the VM:
+
+```bash
+ansible mgmt -b -m command -a "k3s kubectl diff -f /opt/lab-mgmt/capi-providers.yaml"
+# rc 0, empty — nothing actually differs
+ansible mgmt -b -m command -a "k3s kubectl apply --dry-run=server -f /opt/lab-mgmt/capi-providers.yaml"
+# secret/capmox-variables configured (server dry run)   <- everything else "unchanged"
+```
+
+Root cause: the Secret used `stringData`, which the API server folds into `data` and never
+stores, so client-side apply's three-way merge sees it missing every time, sends a patch and
+prints `configured` even though the stored `data` is identical. Fix: template writes `data` with
+`| b64encode` values. Expect one more `changed` (template file + last-applied annotation
+rewrite), then `changed=0`.
+
+Also from this check: the widened inspector RBAC was not applied yet (`get nodes` still
+Forbidden), so no clean full run had completed before this fix. `clusterctl` v1.12.11
+darwin/arm64 is installed in `~/bin`; `clusterctl generate cluster lab1 --infrastructure proxmox:v0.9.1 --target-namespace default --list-variables`
+lists no `PROXMOX_*` credentials, confirming `clusterctl.yaml` only needs workload values now.