diff --git a/apps/postgres/ca.yaml b/apps/postgres/ca.yaml
index 5233953..2a40922 100644
--- a/apps/postgres/ca.yaml
+++ b/apps/postgres/ca.yaml
@@ -8,6 +8,9 @@ spec:
   isCA: true
   commonName: postgres-ca
   secretName: postgres-ca
+  secretTemplate:
+    labels:
+      cnpg.io/reload: ""
   privateKey:
     algorithm: ECDSA
     size: 256
diff --git a/apps/postgres/certs.yaml b/apps/postgres/certs.yaml
index 11c170e..ed58eb6 100644
--- a/apps/postgres/certs.yaml
+++ b/apps/postgres/certs.yaml
@@ -31,6 +31,9 @@ metadata:
   name: postgres-replication-cert
 spec:
   secretName: postgres-replication-cert
+  secretTemplate:
+    labels:
+      cnpg.io/reload: ""
   usages:
     - client auth
   commonName: streaming_replica