diff --git a/.env.example b/.env.example
index 9874bce..ee621ee 100644
--- a/.env.example
+++ b/.env.example
@@ -38,5 +38,11 @@ SWITCHBOT_SECRET=your_switchbot_secret_here
 # Immich database credentials
 IMMICH_POSTGRES_PASSWORD=your_password_here
 
+# Gitea database credentials (rotated off the plaintext value formerly in values/gitea.yaml)
+GITEA_POSTGRES_PASSWORD=your_password_here
+
+# Dashy weather widget API key (rotated off the plaintext value formerly in config/dashy/conf.yaml)
+DASHY_WEATHER_API_KEY=your_api_key_here
+
 PIA_USER=your_pia_username_here
 PIA_PASSWORD=your_pia_password_here
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 57097be..cfe2411 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,11 @@
 .env
 .DS_Store
 tmp/
-old.debian-data
\ No newline at end of file
+old.debian-data
+*.retry
+.vault_pass*
+kubeconfig*
+*.kubeconfig
+*.swp
+*.swo
+*~
\ No newline at end of file
diff --git a/config/dashy/conf.yaml b/config/dashy/conf.yaml
index c0443c2..c33d01c 100644
--- a/config/dashy/conf.yaml
+++ b/config/dashy/conf.yaml
@@ -1,5 +1,5 @@
 # Config for: Dashy dashboard
-# Applied by: manifests/apply-dashy-config.sh (creates ConfigMap from this file)
+# Applied by: manifests/core/apply-dashy-config.sh (renders secrets from .env, creates ConfigMap from this file)
 
 pageInfo:
   title: Good morning, Nik
@@ -60,14 +60,14 @@ sections:
         id: 1_928_iframe
       - type: weather
         options:
-          apiKey: 770d36389dd547e8e3daccb39debde64
+          apiKey: "${DASHY_WEATHER_API_KEY}"
           city: Tokyo, JP
           units: metric
           hideDetails: false
         id: 2_928_weather
       - type: weather-forecast
         options:
-          apiKey: 770d36389dd547e8e3daccb39debde64
+          apiKey: "${DASHY_WEATHER_API_KEY}"
           city: Tokyo, JP
           numDays: 5
           units: metric
diff --git a/manifests/authentik/authentik-ingress.yaml b/manifests/authentik/authentik-ingress.yaml
index 3a031b1..3c209ce 100644
--- a/manifests/authentik/authentik-ingress.yaml
+++ b/manifests/authentik/authentik-ingress.yaml
@@ -9,7 +9,7 @@ metadata:
 spec:
   secretName: authentik-tls
   issuerRef:
-    name: internal-ca
+    name: internal-ca-issuer
     kind: ClusterIssuer
   dnsNames:
     - auth.home.arpa
diff --git a/manifests/core/apply-dashy-config.sh b/manifests/core/apply-dashy-config.sh
index 383abec..d8a05c9 100644
--- a/manifests/core/apply-dashy-config.sh
+++ b/manifests/core/apply-dashy-config.sh
@@ -1,12 +1,18 @@
 #!/usr/bin/env bash
 # Usage: bash manifests/core/apply-dashy-config.sh
-# Description: Updates the Dashy ConfigMap from config/dashy/conf.yaml and restarts the deployment
+# Description: Renders config/dashy/conf.yaml with secrets from .env, updates the Dashy ConfigMap, and restarts the deployment
 set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../.env"
+
+RENDERED="$(mktemp)"
+trap 'rm -f "$RENDERED"' EXIT
+sed "s|\${DASHY_WEATHER_API_KEY}|${DASHY_WEATHER_API_KEY}|g" "$SCRIPT_DIR/../../config/dashy/conf.yaml" > "$RENDERED"
 
 kubectl create configmap dashy-config \
-  --from-file=conf.yml=config/dashy/conf.yaml \
+  --from-file=conf.yml="$RENDERED" \
   --namespace dashy \
   --dry-run=client -o yaml | kubectl apply -f -
 
 kubectl rollout restart deployment/dashy -n dashy
-echo "Dashy config updated"
\ No newline at end of file
+echo "Dashy config updated"
diff --git a/manifests/gitea/gitea-postgres-secret.sh b/manifests/gitea/gitea-postgres-secret.sh
new file mode 100755
index 0000000..15b007e
--- /dev/null
+++ b/manifests/gitea/gitea-postgres-secret.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../.env"
+
+kubectl create secret generic gitea-postgres-secret \
+  --namespace=gitea \
+  --from-literal=postgresql-password="${GITEA_POSTGRES_PASSWORD}" \
+  --dry-run=client -o yaml \
+  | kubeseal \
+      --controller-namespace=kube-system \
+      --controller-name=sealed-secrets-controller \
+      --format yaml \
+      > "$SCRIPT_DIR/gitea-postgres-sealed.yaml"
+
+echo "Wrote $SCRIPT_DIR/gitea-postgres-sealed.yaml"
diff --git a/manifests/network/traefik-dashboard-ingress.yaml b/manifests/network/traefik-dashboard-ingress.yaml
index 5ac7d76..8309283 100644
--- a/manifests/network/traefik-dashboard-ingress.yaml
+++ b/manifests/network/traefik-dashboard-ingress.yaml
@@ -63,7 +63,7 @@ metadata:
 spec:
   secretName: traefik-dashboard-tls
   issuerRef:
-    name: internal-ca
+    name: internal-ca-issuer
     kind: ClusterIssuer
   dnsNames:
     - traefik.home.arpa
diff --git a/values/gitea.yaml b/values/gitea.yaml
index 68fa248..4afb487 100644
--- a/values/gitea.yaml
+++ b/values/gitea.yaml
@@ -45,9 +45,12 @@ postgresql:
   global:
     postgresql:
       auth:
-        password: gitea-db-password
         username: gitea
         database: gitea
+        existingSecret: gitea-postgres-secret
+        secretKeys:
+          adminPasswordKey: postgresql-password
+          userPasswordKey: postgresql-password
 
 service:
   ssh: