diff --git a/cmd/apply.go b/cmd/apply.go
index 970dba6..cf17c00 100644
--- a/cmd/apply.go
+++ b/cmd/apply.go
@@ -789,7 +789,7 @@ func handleSidecarServerCert(ctx context.Context, cfg *config.CocoConfig, appNam
 }
 
 // saveSidecarCertsToYAML saves sidecar server certificate and key to a YAML file
-// as a Kubernetes TLS Secret. The file is saved alongside the manifest with the
+// as a Kubernetes Opaque Secret. The file is saved alongside the manifest with the
 // naming convention {basename}-sidecar-certs.yaml, matching the existing pattern
 // used by other generated files (e.g., {basename}-sealed-secrets.yaml).
 func saveSidecarCertsToYAML(manifestPath string, serverCert *certs.CertificateSet, appName, namespace string) (string, error) {
@@ -801,7 +801,7 @@ func saveSidecarCertsToYAML(manifestPath string, serverCert *certs.CertificateSe
 	baseName := strings.TrimSuffix(manifestPath, ext)
 	certFilePath := baseName + "-sidecar-certs.yaml"
 
-	// Build Kubernetes Secret structure (kubernetes.io/tls)
+	// Build Kubernetes Secret structure (Opaque; keys are server-cert/server-key)
 	secretData := map[string]interface{}{
 		"apiVersion": "v1",
 		"kind":       "Secret",
@@ -809,10 +809,10 @@ func saveSidecarCertsToYAML(manifestPath string, serverCert *certs.CertificateSe
 			"name":      "sidecar-tls-" + appName,
 			"namespace": namespace,
 		},
-		"type": "kubernetes.io/tls",
+		"type": "Opaque",
 		"data": map[string]string{
-			"tls.crt": base64.StdEncoding.EncodeToString(serverCert.CertPEM),
-			"tls.key": base64.StdEncoding.EncodeToString(serverCert.KeyPEM),
+			"server-cert": base64.StdEncoding.EncodeToString(serverCert.CertPEM),
+			"server-key":  base64.StdEncoding.EncodeToString(serverCert.KeyPEM),
 		},
 	}
 
diff --git a/cmd/apply_skip_test.go b/cmd/apply_skip_test.go
index 40d2d4a..a26eb66 100644
--- a/cmd/apply_skip_test.go
+++ b/cmd/apply_skip_test.go
@@ -136,7 +136,7 @@ func TestSkipApply_NamespaceResolution_DefaultFallback(t *testing.T) {
 }
 
 // TestSkipApply_SidecarCertFileSaving tests that saveSidecarCertsToYAML creates
-// a properly formatted Kubernetes TLS Secret YAML file with correct permissions.
+// a properly formatted Kubernetes Opaque Secret YAML file with KBS-matching key names.
 func TestSkipApply_SidecarCertFileSaving(t *testing.T) {
 	// Generate a CA for signing the server cert
 	ca, err := certs.GenerateCA("test-ca")
@@ -208,8 +208,8 @@ func TestSkipApply_SidecarCertFileSaving(t *testing.T) {
 	}
 
 	// Verify type
-	if secretType, ok := secret["type"].(string); !ok || secretType != "kubernetes.io/tls" {
-		t.Errorf("type = %v, want %q", secret["type"], "kubernetes.io/tls")
+	if secretType, ok := secret["type"].(string); !ok || secretType != "Opaque" {
+		t.Errorf("type = %v, want %q", secret["type"], "Opaque")
 	}
 
 	// Verify metadata
@@ -230,33 +230,29 @@ func TestSkipApply_SidecarCertFileSaving(t *testing.T) {
 		t.Fatalf("data is not a map: %T", secret["data"])
 	}
 
-	tlsCrt, ok := secretData["tls.crt"].(string)
-	if !ok || tlsCrt == "" {
-		t.Error("data[tls.crt] is missing or empty")
+	serverCertData, ok := secretData["server-cert"].(string)
+	if !ok || serverCertData == "" {
+		t.Error("data[server-cert] is missing or empty")
 	} else {
-		// Verify tls.crt is valid base64
-		decoded, err := base64.StdEncoding.DecodeString(tlsCrt)
+		decoded, err := base64.StdEncoding.DecodeString(serverCertData)
 		if err != nil {
-			t.Errorf("data[tls.crt] is not valid base64: %v", err)
+			t.Errorf("data[server-cert] is not valid base64: %v", err)
 		}
-		// Verify decoded content matches the original cert PEM
 		if string(decoded) != string(serverCert.CertPEM) {
-			t.Error("data[tls.crt] decoded content does not match original cert PEM")
+			t.Error("data[server-cert] decoded content does not match original cert PEM")
 		}
 	}
 
-	tlsKey, ok := secretData["tls.key"].(string)
-	if !ok || tlsKey == "" {
-		t.Error("data[tls.key] is missing or empty")
+	serverKeyData, ok := secretData["server-key"].(string)
+	if !ok || serverKeyData == "" {
+		t.Error("data[server-key] is missing or empty")
 	} else {
-		// Verify tls.key is valid base64
-		decoded, err := base64.StdEncoding.DecodeString(tlsKey)
+		decoded, err := base64.StdEncoding.DecodeString(serverKeyData)
 		if err != nil {
-			t.Errorf("data[tls.key] is not valid base64: %v", err)
+			t.Errorf("data[server-key] is not valid base64: %v", err)
 		}
-		// Verify decoded content matches the original key PEM
 		if string(decoded) != string(serverCert.KeyPEM) {
-			t.Error("data[tls.key] decoded content does not match original key PEM")
+			t.Error("data[server-key] decoded content does not match original key PEM")
 		}
 	}
 }