diff --git a/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl
index 6456cbd..0c4e9b0 100644
--- a/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl
+++ b/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl
@@ -4,10 +4,20 @@ image:
   tag: "latest"
 
 satosa:
-  replicas: 2
+  replicas: 1
   envVars:
     BASE_URL: https://oidc2fer.127.0.0.1.nip.io
     GUNICORN_CMD_ARGS: --workers=3
+
+    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
+
+    STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
+    SAML2_BACKEND_CERT:   { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT   } }
+    SAML2_BACKEND_KEY:    { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY    } }
+    OIDC_FRONTEND_KEY:    { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY    } }
+
+    OIDC_DB_URI: "redis://:pass@redis-master:6379"
     CLIENT_DB_JSON: |-
       {
         "oidc-test-client": {
@@ -23,13 +33,6 @@ satosa:
           "token_endpoint_auth_method": "client_secret_post"
         }
       }
-    SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
-    SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
-    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
-    OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
-    OIDC_DB_URI: "redis://:pass@redis-master:6379"
-    STATE_ENCRYPTION_KEY: "{{ .Values.STATE_ENCRYPTION_KEY }}"
 
 ingress:
   enabled: true
diff --git a/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl
index e5cbf15..4fda979 100644
--- a/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl
+++ b/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl
@@ -8,17 +8,17 @@ satosa:
   envVars:
     BASE_URL: https://oidc2fer-staging.beta.numerique.gouv.fr
     GUNICORN_CMD_ARGS: --workers=3
-    SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
-    SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
+
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
     SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
-    OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
-    OIDC_DB_URI:
-      secretKeyRef:
-        name: redis.redis.libre.sh
-        key: url
-    STATE_ENCRYPTION_KEY: "{{ .Values.STATE_ENCRYPTION_KEY }}"
-    CLIENT_DB_JSON: {{ .Values.CLIENT_DB_JSON | toYaml | indent 8 }}
+
+    STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
+    SAML2_BACKEND_CERT:   { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT   } }
+    SAML2_BACKEND_KEY:    { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY    } }
+    OIDC_FRONTEND_KEY:    { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY    } }
+    CLIENT_DB_JSON:       { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON       } }
+
+    OIDC_DB_URI: { secretKeyRef: { name: redis.redis.libre.sh, key: url } }
 
 ingress:
   enabled: true
diff --git a/src/helm/helmfile.yaml b/src/helm/helmfile.yaml
index bcd4b33..05a0cbd 100644
--- a/src/helm/helmfile.yaml
+++ b/src/helm/helmfile.yaml
@@ -18,6 +18,8 @@ releases:
     installed: {{ ne .Environment.Name "dev" | toYaml }}
     namespace: {{ .Namespace }}
     chart: ./extra
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
 
   - name: oidc2fer
     version: 0.0.1 # {{ .Values.version }}
diff --git a/src/helm/oidc2fer/templates/secrets.yaml b/src/helm/oidc2fer/templates/secrets.yaml
new file mode 100644
index 0000000..9deeb5c
--- /dev/null
+++ b/src/helm/oidc2fer/templates/secrets.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oidc2fer
+  namespace: {{ .Release.Namespace | quote }}
+stringData:
+  STATE_ENCRYPTION_KEY: {{ .Values.STATE_ENCRYPTION_KEY | quote }}
+  SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
+  SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
+  OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
+  CLIENT_DB_JSON: {{ .Values.CLIENT_DB_JSON | toYaml | indent 8 }}