diff --git a/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml b/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml
index b8e6e466f..5b45adcc2 100644
--- a/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml
+++ b/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml
@@ -8,11 +8,13 @@ Use the build/bin/set-cli-image-digest.sh script to update this value across all
 {{- $_cli_image_digest := "sha256:b6df7b173b131d7340087a1a5d7ed51ff16cef7fcac7291a269b2ad1937a61af" }}
 
 {{ $ns := printf "mas-%s-core" .Values.instance_id }}
+{{ $syncres_ns := printf "mas-%s-syncres" .Values.instance_id }}
 {{ $prefix := printf "post-jdbc-usr-%s" .Values.mas_config_name }}
-{{ $secret := printf "%s-creds" $prefix }}
 {{ $sa := printf "%s-sa" $prefix }}
 {{ $role := printf "%s-role" $prefix }}
 {{ $rb := printf "%s-rb" $prefix }}
+{{ $syncres_role := printf "%s-syncres-role" $prefix }}
+{{ $syncres_rb := printf "%s-syncres-rb" $prefix }}
 {{ $np := printf "%s-np" $prefix }}
 {{ $job := printf "%s-job" $prefix }}
 
@@ -23,7 +25,7 @@ metadata:
   name: {{ $sa }}
   namespace: {{ $ns }}
   annotations:
-    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook: PostDelete
     argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
 {{- if .Values.custom_labels }}
   labels:
@@ -32,6 +34,53 @@ metadata:
 
 
 
+
+---
+# Role in syncres namespace — grants the postdelete SA read access to the aws credentials secret.
+# This avoids embedding AVP placeholder tokens (sm_aws_access_key_id / sm_aws_secret_access_key)
+# as literal env var values in the Job, which would cause AVP to try to resolve them at manifest
+# generation time and fail if the upstream AWS SM secret has since been deleted.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ $syncres_role }}
+  namespace: {{ $syncres_ns }}
+  annotations:
+    argocd.argoproj.io/hook: PostDelete
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
+{{- if .Values.custom_labels }}
+  labels:
+{{ .Values.custom_labels | toYaml | indent 4 }}
+{{- end }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["aws"]
+
+---
+# RoleBinding in syncres namespace to bind the postdelete SA from mas-core namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $syncres_rb }}
+  namespace: {{ $syncres_ns }}
+  annotations:
+    argocd.argoproj.io/hook: PostDelete
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
+{{- if .Values.custom_labels }}
+  labels:
+{{ .Values.custom_labels | toYaml | indent 4 }}
+{{- end }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $sa }}
+    namespace: {{ $ns }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ $syncres_role }}
+
 ---
 # Role in DB2 namespace for accessing DB2 resources
 # This allows the service account from mas-core namespace to access resources in db2 namespace
@@ -41,7 +90,7 @@ metadata:
   name: {{ $role }}
   namespace: {{ .Values.db2_namespace }}
   annotations:
-    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook: PostDelete
     argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
 {{- if .Values.custom_labels }}
   labels:
@@ -70,6 +119,7 @@ rules:
     - get
     - list
 
+
 ---
 # RoleBinding in DB2 namespace to bind the service account from mas-core namespace
 kind: RoleBinding
@@ -78,7 +128,7 @@ metadata:
   name: {{ $rb }}
   namespace: {{ .Values.db2_namespace }}
   annotations:
-    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook: PostDelete
     argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
 {{- if .Values.custom_labels }}
   labels:
@@ -93,6 +143,30 @@ roleRef:
   kind: Role
   name: {{ $role }}
 
+---
+# Permit outbound communication by the Job pods
+# (Needed to communicate with the K8S HTTP API and AWS SM)
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ $np }}
+  namespace: {{ $ns }}
+  annotations:
+    argocd.argoproj.io/hook: PostDelete
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
+{{- if .Values.custom_labels }}
+  labels:
+{{ .Values.custom_labels | toYaml | indent 4 }}
+{{- end }}
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ $job }}
+  egress:
+    - {}
+  policyTypes:
+    - Egress
+
 ---
 apiVersion: batch/v1
 kind: Job
@@ -144,24 +218,16 @@ spec:
             - name: MAS_INSTANCE_ID
               value: "{{ .Values.instance_id }}"
               
-            # Hard-coded for now:
+            # AWS SM credentials are read at runtime from the aws Secret in the syncres namespace
+            # (via the syncres Role/RoleBinding above) to avoid embedding AVP placeholder tokens
+            # as literal values — which would cause manifest generation failures during deprovisioning
+            # if the upstream AWS SM secret has since been deleted.
             - name: AVP_TYPE
               value: "aws"
             - name: SM_AWS_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: aws
-                  key: aws_default_region
-            - name: SM_AWS_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: aws
-                  key: aws_access_key_id
-            - name: SM_AWS_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: aws
-                  key: aws_secret_access_key
+              value: "{{ .Values.region_id }}"
+            - name: SYNCRES_NS
+              value: "{{ $syncres_ns }}"
 
           command:
             - /bin/sh
@@ -178,11 +244,15 @@ spec:
               SECRETS_KEY_SEPERATOR="/"
               SECRET_NAME_JDBC_CONFIG=${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}${MAS_INSTANCE_ID}${SECRETS_KEY_SEPERATOR}jdbc${SECRETS_KEY_SEPERATOR}${DB2_INSTANCE_NAME}${SECRETS_KEY_SEPERATOR}config
 
+              export SM_AWS_ACCESS_KEY_ID=$(oc get secret aws -n ${SYNCRES_NS} -o jsonpath='{.data.aws_access_key_id}' | base64 -d)
+              export SM_AWS_SECRET_ACCESS_KEY=$(oc get secret aws -n ${SYNCRES_NS} -o jsonpath='{.data.aws_secret_access_key}' | base64 -d)
+
               echo "Params:"
               echo "    - ACCOUNT_ID                 ................... ${ACCOUNT_ID}"
               echo "    - CLUSTER_ID                 ................... ${CLUSTER_ID}"
               echo "    - MAS_INSTANCE_ID            ................... ${MAS_INSTANCE_ID}"
               echo "    - SECRET_NAME_JDBC_CONFIG    ................... ${SECRET_NAME_JDBC_CONFIG}"
+              echo "    - SYNCRES_NS                 ................... ${SYNCRES_NS}"
               echo "    - SM_AWS_REGION              ................... ${SM_AWS_REGION}"
               echo "    - SM_AWS_ACCESS_KEY_ID       ................... ${SM_AWS_ACCESS_KEY_ID:0:2}<snip>"
               echo "    - SM_AWS_SECRET_ACCESS_KEY   ................... ${SM_AWS_SECRET_ACCESS_KEY:0:2}<snip>"
diff --git a/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml b/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml
index 23520d222..fb2449eea 100644
--- a/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml
+++ b/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml
@@ -30,7 +30,7 @@ metadata:
     {{- end }}
   finalizers:
     - resources-finalizer.argocd.argoproj.io
-    - post-delete-finalizer.argocd.argoproj.io	
+    - post-delete-finalizer.argocd.argoproj.io
     - post-delete-finalizer.argocd.argoproj.io/cleanup
   labels:
     environment: '{{ $.Values.account.id }}'