diff --git a/apps/overlays/au-syd1/logging/values-nats.yaml b/apps/overlays/au-syd1/logging/values-nats.yaml
index 956ebd2..fc16bd2 100644
--- a/apps/overlays/au-syd1/logging/values-nats.yaml
+++ b/apps/overlays/au-syd1/logging/values-nats.yaml
@@ -22,16 +22,19 @@ config:
         size: 180Gi
         storageClassName: cephrbd-fast-delete
   # Per-user auth with publish/subscribe separation. Passwords are injected as
-  # env vars from the Vault-synced nats-auth Secret (NATS expands $VAR in config).
+  # env vars from the Vault-synced nats-auth Secret. The `<< $VAR >>` wrapping is
+  # REQUIRED by this chart: it renders the value UNQUOTED in nats.conf so the
+  # NATS server expands the env var. A plain `$VAR` is JSON-quoted ("$VAR") and
+  # NATS then treats it as a literal string — which broke auth for every client.
   merge:
     authorization:
       users:
         # Bootstrap Job (stream/consumer management) — full JetStream API.
         - user: log-admin
-          password: $NATS_ADMIN_PASSWORD
+          password: << $NATS_ADMIN_PASSWORD >>
         # Edge publishers (k8s DaemonSet + VM ingest) — publish only.
         - user: log-producer
-          password: $NATS_PRODUCER_PASSWORD
+          password: << $NATS_PRODUCER_PASSWORD >>
           permissions:
             publish:
               allow:
@@ -42,7 +45,7 @@ config:
         # Consumers (transform tier + archiver) — pull + ack only, no publish
         # to log subjects.
         - user: log-consumer
-          password: $NATS_CONSUMER_PASSWORD
+          password: << $NATS_CONSUMER_PASSWORD >>
           permissions:
             publish:
               allow: