diff --git a/apps/authentik.yaml b/apps/authentik.yaml
index a39eec2..779d1d3 100644
--- a/apps/authentik.yaml
+++ b/apps/authentik.yaml
@@ -21,12 +21,16 @@ spec:
     helm:
       valuesObject:
         authentik:
-          secret_key: "PleaseGenerateA50CharKey"
           postgresql:
             host: postgres-cluster-rw.postgres
 
         global:
           env:
+            - name: AUTHENTIK_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: secret-key
+                  key: password
             - name: AUTHENTIK_STORAGE__MEDIA__BACKEND
               value: s3
             # TODO: configure s3
@@ -93,3 +97,16 @@ spec:
                 name: postgres-ca
                 kind: ClusterIssuer
                 group: cert-manager.io
+
+          - apiVersion: external-secrets.io/v1
+            kind: ExternalSecret
+            metadata:
+              name: secret-key
+            spec:
+              refreshPolicy: CreatedOnce
+              dataFrom:
+              - sourceRef:
+                  generatorRef:
+                    apiVersion: generators.external-secrets.io/v1alpha1
+                    kind: ClusterGenerator
+                    name: password