diff --git a/lib/forgejo-stack.ts b/lib/forgejo-stack.ts
index c4c20d3..fa0c185 100644
--- a/lib/forgejo-stack.ts
+++ b/lib/forgejo-stack.ts
@@ -167,6 +167,10 @@ export class ForgejoStack extends cdk.Stack {
         secretAccessKey: gcsTransferKey.secretAccessKey,
       },
     });
+    // Preserve the logical ID to avoid CloudFormation replacement
+    const gcsTransferCredentialsResource = gcsTransferCredentials.node.defaultChild as secretsmanager.CfnSecret;
+    gcsTransferCredentialsResource.overrideLogicalId("GcsTransferCredentials");
+
     const userData = ec2.UserData.forLinux();
     userData.addCommands(
       "set -euxo pipefail",