diff --git a/deploy/repositories/ascoachingogvaner.yaml b/deploy/repositories/ascoachingogvaner.yaml
index 4858c9a..61229d4 100644
--- a/deploy/repositories/ascoachingogvaner.yaml
+++ b/deploy/repositories/ascoachingogvaner.yaml
@@ -5,18 +5,16 @@ metadata:
   annotations:
     crossplane.io/external-name: ascoachingogvaner
 spec:
-  # Observe-only: this file declares `visibility: private` while the live
-  # repository is public and serving a site, so acting on the declaration would
-  # take the site off the public internet. Which side is wrong is the
-  # maintainer's call, tracked on devantler-tech/.github#123 — until it is made,
-  # Crossplane mirrors this repo read-only and writes nothing. Restoring
-  # Create/Update is what enacts the decision, once `visibility` below has been
-  # set to the answer.
+  # Observe-only: Crossplane mirrors this repository read-only and writes nothing.
+  # The repository is public and serves the live AS Coaching og Vaner site, and the
+  # visibility below states that live value — so enacting this declaration would be
+  # a no-op rather than a change. Enabling Create/Update is a separate, deliberate
+  # step, tracked on devantler-tech/.github#123.
   managementPolicies:
     - Observe
   forProvider:
     name: ascoachingogvaner
-    visibility: private
+    visibility: public
     archived: false
     description: "AS Coaching og Vaner — coaching website (platform tenant)"
   providerConfigRef:
diff --git a/deploy/repositories/kustomization.yaml b/deploy/repositories/kustomization.yaml
index 4eab00c..73f8765 100644
--- a/deploy/repositories/kustomization.yaml
+++ b/deploy/repositories/kustomization.yaml
@@ -28,10 +28,14 @@ resources:
   - homebrew-tap.yaml
   - world-at-ruin.yaml
   - doggy-countdown.yaml
-  # Private repos.
+  - fleet-gitops.yaml
+  # Observe-only (read-only mirror; Crossplane writes nothing). These two are
+  # public and serve live sites. They are listed apart because of their
+  # management policy, not their visibility — grouping them as "private repos"
+  # described neither correctly. Promoting them to Observe/Create/Update is
+  # tracked on devantler-tech/.github#123.
   - ascoachingogvaner.yaml
   - wedding-app.yaml
-  - fleet-gitops.yaml
 # Org-wide repo settings applied to EVERY Repository, single source of truth
 # (auto-applies to every future repo):
 #  - squash-only merge policy (merge commits + rebase disabled; auto-merge,
diff --git a/deploy/repositories/wedding-app.yaml b/deploy/repositories/wedding-app.yaml
index 07c2d2d..2ec88eb 100644
--- a/deploy/repositories/wedding-app.yaml
+++ b/deploy/repositories/wedding-app.yaml
@@ -5,18 +5,16 @@ metadata:
   annotations:
     crossplane.io/external-name: wedding-app
 spec:
-  # Observe-only: this file declares `visibility: private` while the live
-  # repository is public and serving a site, so acting on the declaration would
-  # take the site off the public internet. Which side is wrong is the
-  # maintainer's call, tracked on devantler-tech/.github#123 — until it is made,
-  # Crossplane mirrors this repo read-only and writes nothing. Restoring
-  # Create/Update is what enacts the decision, once `visibility` below has been
-  # set to the answer.
+  # Observe-only: Crossplane mirrors this repository read-only and writes nothing.
+  # The repository is public and serves the live wedding site, and the visibility
+  # below states that live value — so enacting this declaration would be a no-op
+  # rather than a change. Enabling Create/Update is a separate, deliberate step,
+  # tracked on devantler-tech/.github#123.
   managementPolicies:
     - Observe
   forProvider:
     name: wedding-app
-    visibility: private
+    visibility: public
     archived: false
     description: "A simple wedding API service deployed to the devantler-tech/platform Kubernetes cluster."
   providerConfigRef: