diff --git a/src/server/services/agent-runtime.service.ts b/src/server/services/agent-runtime.service.ts
index eafb6da6..b5bdfc57 100644
--- a/src/server/services/agent-runtime.service.ts
+++ b/src/server/services/agent-runtime.service.ts
@@ -210,8 +210,11 @@ class AgentRuntimeService {
         }, {
             [Constants.QS_ANNOTATION_AGENT_ID]: agent.id,
             [Constants.QS_ANNOTATION_SANDBOX_NAME]: sandboxName,
-            ...(customTag ? { [Constants.QS_ANNOTATION_CUSTOM_TAG]: customTag } : {}),
             [Constants.QS_LABEL_AGENT_SANDBOX_VIRTUAL_KEY]: Constants.QS_ANNOTATION_VALUE_TRUE,
+        }, {
+            [Constants.QS_ANNOTATION_AGENT_ID]: agent.id,
+            [Constants.QS_ANNOTATION_SANDBOX_NAME]: sandboxName,
+            ...(customTag ? { [Constants.QS_ANNOTATION_CUSTOM_TAG]: customTag } : {}),
         });
         return virtualKey;
     }
diff --git a/src/server/services/agent-runtime.service.unit.spec.ts b/src/server/services/agent-runtime.service.unit.spec.ts
index 6881aeed..eff19519 100644
--- a/src/server/services/agent-runtime.service.unit.spec.ts
+++ b/src/server/services/agent-runtime.service.unit.spec.ts
@@ -331,7 +331,10 @@ describe('agent-runtime.service', () => {
                     'qs-agent-id': AGENT_ID,
                     'qs-agent-sandbox-virtual-key': 'true',
                     'qs-sandbox-name': expect.stringMatching(/^ac-/),
+                }, {
+                    'qs-agent-id': AGENT_ID,
                     'qs-custom-tag': 'feature-branch',
+                    'qs-sandbox-name': expect.stringMatching(/^ac-/),
                 },
             );
             expect(agentSandboxAdapter.createSandboxClaim).toHaveBeenCalledWith(expect.objectContaining({
diff --git a/src/server/services/secret.service.ts b/src/server/services/secret.service.ts
index c7d5dc5f..15cc97f4 100644
--- a/src/server/services/secret.service.ts
+++ b/src/server/services/secret.service.ts
@@ -134,6 +134,7 @@ class SecretService {
         namespace: string,
         data: Record<string, string>,
         labels?: Record<string, string>,
+        annotations?: Record<string, string>,
     ): Promise<void> {
         const base64Data: Record<string, string> = {};
         for (const [key, value] of Object.entries(data)) {
@@ -141,7 +142,11 @@ class SecretService {
         }
 
         const secretManifest: V1Secret = {
-            metadata: { name, ...(labels ? { labels } : {}) },
+            metadata: {
+                name,
+                ...(labels ? { labels } : {}),
+                ...(annotations ? { annotations } : {}),
+            },
             data: base64Data,
         };
 
diff --git a/src/server/services/secret.service.unit.spec.ts b/src/server/services/secret.service.unit.spec.ts
new file mode 100644
index 00000000..c6051add
--- /dev/null
+++ b/src/server/services/secret.service.unit.spec.ts
@@ -0,0 +1,46 @@
+const k3sMocks = vi.hoisted(() => ({
+    core: {
+        readNamespacedSecret: vi.fn(),
+        createNamespacedSecret: vi.fn(),
+        replaceNamespacedSecret: vi.fn(),
+    },
+}));
+
+vi.mock('@/server/adapter/kubernetes-api.adapter', () => ({ default: k3sMocks }));
+
+import secretService from './secret.service';
+import { Constants } from '@/shared/utils/constants';
+
+describe('secret.service createOrReplaceGenericSecret', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        k3sMocks.core.readNamespacedSecret.mockRejectedValue({ code: 404 });
+    });
+
+    it('writes labels and annotations to their respective metadata fields', async () => {
+        await secretService.createOrReplaceGenericSecret('sandbox-key', 'project-1', {
+            QS_VIRTUAL_KEY: 'virtual-key',
+        }, {
+            [Constants.QS_ANNOTATION_AGENT_ID]: 'agent-1',
+            [Constants.QS_LABEL_AGENT_SANDBOX_VIRTUAL_KEY]: Constants.QS_ANNOTATION_VALUE_TRUE,
+        }, {
+            [Constants.QS_ANNOTATION_CUSTOM_TAG]: 'feature-branch',
+        });
+
+        expect(k3sMocks.core.createNamespacedSecret).toHaveBeenCalledWith({
+            namespace: 'project-1',
+            body: expect.objectContaining({
+                metadata: {
+                    name: 'sandbox-key',
+                    labels: {
+                        [Constants.QS_ANNOTATION_AGENT_ID]: 'agent-1',
+                        [Constants.QS_LABEL_AGENT_SANDBOX_VIRTUAL_KEY]: Constants.QS_ANNOTATION_VALUE_TRUE,
+                    },
+                    annotations: {
+                        [Constants.QS_ANNOTATION_CUSTOM_TAG]: 'feature-branch',
+                    },
+                },
+            }),
+        });
+    });
+});