diff --git a/terraform/litellm/aws/ecs.tf b/terraform/litellm/aws/ecs.tf
index e6848421779..0fe5fe3762a 100644
--- a/terraform/litellm/aws/ecs.tf
+++ b/terraform/litellm/aws/ecs.tf
@@ -213,6 +213,11 @@ resource "aws_ecs_task_definition" "gateway" {
   # never exporting. ca_cert_pem stays optional: empty means fall back to the
   # system trust store.
   #
+  # The guard lives here, on an unconditional resource, rather than on the cert
+  # secret: that secret is count-gated on the cert itself, so it has zero
+  # instances in exactly the case this must catch. Adding count or for_each to
+  # this resource would silently stop the guard from evaluating.
+  #
   #   endpoint  cert  key  -> result
   #   ""        any   any  -> metering off, no secrets created
   #   set       set   set  -> metering on
diff --git a/terraform/litellm/gcp/cloudrun.tf b/terraform/litellm/gcp/cloudrun.tf
index 5b47f1e08f4..fa66d71f077 100644
--- a/terraform/litellm/gcp/cloudrun.tf
+++ b/terraform/litellm/gcp/cloudrun.tf
@@ -171,6 +171,11 @@ resource "google_cloud_run_v2_service" "gateway" {
   # never exporting. ca_cert_pem stays optional: empty means fall back to the
   # system trust store.
   #
+  # The guard lives here, on an unconditional resource, rather than on the cert
+  # secret: that secret is count-gated on the cert itself, so it has zero
+  # instances in exactly the case this must catch. Adding count or for_each to
+  # this resource would silently stop the guard from evaluating.
+  #
   #   endpoint  cert  key  -> result
   #   ""        any   any  -> metering off, no secrets created
   #   set       set   set  -> metering on