diff --git a/.checkov.yaml b/.checkov.yaml
index 8a8c8b89..645a5dff 100644
--- a/.checkov.yaml
+++ b/.checkov.yaml
@@ -8,5 +8,5 @@
 # which is only bound at `helm install`/`helm template` time. Checkov's helm
 # framework renders the chart without a namespace override, so it always
 # resolves to "default" and trips CKV_K8S_21 even though the chart is
-# namespace-agnostic by design. Suppressed the same way, per-file.
+# namespace-agnostic by design. Suppressed via metadata annotations on each resource.
 skip-check: []
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 938e1e14..1bd027ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Checkov flagged the knowledge-explorer Helm chart for using the default Kubernetes namespace** ([code scanning alert #779](https://github.com/semantica-agi/semantica/security/code-scanning/779), [#778](https://github.com/semantica-agi/semantica/security/code-scanning/778), [#777](https://github.com/semantica-agi/semantica/security/code-scanning/777), `CKV_K8S_21`) by @KaifAhmad1
   - `templates/service.yaml`, `templates/deployment.yaml`, and `templates/configmap.yaml` all already set `metadata.namespace` to `{{ .Release.Namespace }}`, which is only bound at `helm install`/`helm template` time; Checkov's helm framework renders the chart without a namespace override, so it always resolves to `default` and trips `CKV_K8S_21` even though the chart is namespace-agnostic by design
-  - Added a `# checkov:skip=CKV_K8S_21` comment to each of the three files, following the same per-file suppression convention already used for the Cloud Run false positives in `deploy/gcp/cloudrun-service.yaml`, and documented the reasoning in `.checkov.yaml`
+  - Added a `checkov.io/skip1: CKV_K8S_21` metadata annotation to each of the three files to suppress the scanner artifact false-positive properly in Helm templates, and documented the reasoning in `.checkov.yaml`
 
 - **No React error boundaries around lazy-loaded Explorer workspaces — a single render error crashed the whole app** (#768, #794) by @Sameer6305
   - Added an `ErrorBoundary` class component (`explorer/src/ErrorBoundary.tsx`) and wrapped each lazy-loaded workspace's `<Suspense>` block in `App.tsx` with it, keyed on the active sub-view so navigating away from and back to a crashed tab remounts it cleanly
diff --git a/deploy/helm/knowledge-explorer/templates/configmap.yaml b/deploy/helm/knowledge-explorer/templates/configmap.yaml
index 33dc2d33..0c8797c1 100644
--- a/deploy/helm/knowledge-explorer/templates/configmap.yaml
+++ b/deploy/helm/knowledge-explorer/templates/configmap.yaml
@@ -1,6 +1,4 @@
-# checkov:skip=CKV_K8S_21: namespace is set via .Release.Namespace, bound only at helm install/template time
-# Checkov's helm renderer runs without a namespace override, so this always resolves to "default" here —
-# a scanner artifact, not the deployed value; see .checkov.yaml
+
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -8,6 +6,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "knowledge-explorer.labels" . | nindent 4 }}
+  annotations:
+    checkov.io/skip1: CKV_K8S_21=namespace is set via .Release.Namespace, bound only at helm install/template time
 data:
   {{- range $key, $value := .Values.env }}
   {{ $key }}: {{ $value | quote }}
diff --git a/deploy/helm/knowledge-explorer/templates/deployment.yaml b/deploy/helm/knowledge-explorer/templates/deployment.yaml
index 110404f0..047f655e 100644
--- a/deploy/helm/knowledge-explorer/templates/deployment.yaml
+++ b/deploy/helm/knowledge-explorer/templates/deployment.yaml
@@ -1,6 +1,4 @@
-# checkov:skip=CKV_K8S_21: namespace is set via .Release.Namespace, bound only at helm install/template time
-# Checkov's helm renderer runs without a namespace override, so this always resolves to "default" here —
-# a scanner artifact, not the deployed value; see .checkov.yaml
+
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,6 +6,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "knowledge-explorer.labels" . | nindent 4 }}
+  annotations:
+    checkov.io/skip1: CKV_K8S_21=namespace is set via .Release.Namespace, bound only at helm install/template time
 spec:
   {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
diff --git a/deploy/helm/knowledge-explorer/templates/service.yaml b/deploy/helm/knowledge-explorer/templates/service.yaml
index 60765841..6b5400a5 100644
--- a/deploy/helm/knowledge-explorer/templates/service.yaml
+++ b/deploy/helm/knowledge-explorer/templates/service.yaml
@@ -1,6 +1,4 @@
-# checkov:skip=CKV_K8S_21: namespace is set via .Release.Namespace, bound only at helm install/template time
-# Checkov's helm renderer runs without a namespace override, so this always resolves to "default" here —
-# a scanner artifact, not the deployed value; see .checkov.yaml
+
 apiVersion: v1
 kind: Service
 metadata:
@@ -8,6 +6,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "knowledge-explorer.labels" . | nindent 4 }}
+  annotations:
+    checkov.io/skip1: CKV_K8S_21=namespace is set via .Release.Namespace, bound only at helm install/template time
 spec:
   type: {{ .Values.service.type }}
   ports: