diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 917e153..20be268 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -42,3 +42,26 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  notify-argocd:
+    runs-on: ubuntu-latest
+    if: |
+      github.event_name != 'pull_request'
+    needs:
+      - build-and-push
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: .github/workflows/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
diff --git a/.github/workflows/secrets.enc.env b/.github/workflows/secrets.enc.env
new file mode 100644
index 0000000..140008c
--- /dev/null
+++ b/.github/workflows/secrets.enc.env
@@ -0,0 +1,15 @@
+SOPS_PRIVATE=ENC[AES256_GCM,data:k9v8gJJ1ZTDbN8mR9NegKpCC8Kbv9ZqWDx3nhs6YAC6U2gxI0RDg5KRx0juym+5DPEVG4ck8y+ju/4uthRUZd0JkexEJX0WKFTo=,iv:hucEFAC/FTQsE4A+JmuY1PeJJcBRAWUqEul5wplVsJ8=,tag:uCYu26tM4hlheT8bCInA6A==,type:str]
+DOCKER_HUB_PASSWORD=ENC[AES256_GCM,data:gsq8AIbLENiXfOg=,iv:48QhtPLRq0yWpffQPxmkb1FLOkNQ2vp1/o+fnU6QM/o=,tag:s7ADhOZ314EWMc82kRvK+A==,type:str]
+DOCKER_HUB_USER=ENC[AES256_GCM,data:/+bIx0jMNg==,iv:Em3MIFQ8B457gwkRGB0JkRknpEQ1maiqW42gh9/DWDY=,tag:Hc8ZHDludj8up7r0tH2FRw==,type:str]
+ARGOCD_WEBHOOK_URL=ENC[AES256_GCM,data:JHzooEYiqWdH4MjcNT3lL0fxY6YlfyhP6kM0kV6NPBnTtI46ip7nMXZoChkQT7CoPTof3IjMdJaD,iv:/CRQTZhnSi0UxgVd0crnvlVJfStIbYCG3cMTkejW0tU=,tag:p8QAWnwa+M4m9WSQMr7Obw==,type:str]
+ARGOCD_WEBHOOK_SECRET=ENC[AES256_GCM,data:oQyuVQFPmhLIL14hWK0vUxo+r/QEj8hb2uY6bntlEyNqrFg7NOameWFn+dvCsN+C90HT9wD9yhu9aXsV92cJxDI=,iv:MVeeLpJU4taPqoGvJ8bqh6bfLHntRfqic/kIBPY/WV4=,tag:gJXkjUvSjrGjqPqCw6mRyA==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwaTNxODRJT20yRkxRUURB\nU2FzY0FwT3Ayd2VseUpTbGRDajM1WkMvaUdFCnlHN0QvemJJb0I2Mk11NW9FbHNw\nUjZHNURxSnJjTzl4dVg0UmZCVFYrVjAKLS0tIDVFNGlTUDFHakVaeG5pWHJLVXVD\nWWovSEQ0ZmRyeGlBNUhLWXBvUWlScWcKeSW5bRUucnfd+dvwFsNV+A0x5kix7r5H\nPTb0Jdquatq0Mp4Ib+OywzMpCG9p54XhHpPwX41Erlf0dVDfw1uQ6g==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmYUtvajRHWkJzOVk1QUhv\neTNtNndvV1RtOEltQklHcGZlNjJlZUprK0RRCmVsSkFkS1pvM1kzdXBQZFo2Y1lY\naHNUaTRxSGp0aVExUjNqYkdXNjE4WmcKLS0tIGEyamRxZUlscVMxUjBmSXo4K1dm\nVVdhaVgwSEZUNmNBeHJuOFRFa2VZenMK1hxwOLV2TuTQaVAHNnbOSd/+vtp8hIly\nUcMmPJi2cbGYyntRYbLYvASfxZe3bEZodWW51CVK7hRPmDUBs0Y13g==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1h7d5y4w370whuawk5jxz8zv320u766mzhvlg2n6gh6hxvqmxg4psfpr03e
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NHZCR2l2a0pBMm5MTVVt\nK3pIR1RGa0Q5UGJzQS9WSFA4MUdSUmxBcERZCnpIV3ZKS1ZHYitYSnh3elNuNUls\nNzNHdTRnM0YyQTU0N2d5ZjRhMnZvVmMKLS0tIGI3N3YyMktqd1ZzNGYvMzBKME05\neUFpQlV6UFloNlJac1dHZzFiM3BKdWcKeIIGw81XMpXz2YDQvcgoU7L6Xg6VxyJE\nCBVoobMEquhINeVZNnZSR3eGo9ValkRxFtNanAT5jtjgzoyMuir6Mw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1nma4n6pxaywl39cndnu852vx0xs0vh5stcc3qtasdt89u4dqrussvjk5fj
+sops_lastmodified=2024-04-18T10:38:19Z
+sops_mac=ENC[AES256_GCM,data:HGGl4gcXnli8Z7P2P1MspygWRIHJqTLesf/QpiUUC6qH07Qx5bhN5fA1Oo3WTcz+fXkfAY8SV2RZb2CHxo/NouCiATw7vodX1ttwvsUE6RLgdjvMJl4ecWucZMiBdBtpFF4IHrKxswQg1FEdT8U/JP3Gw0TxxaRXIqskXkytp9E=,iv:fPcbne5lDa6+b+DqB+Q2pJ11EB9Vfpvqd9yextCjv7U=,tag:MkVoOpIApCIluFzsazl16w==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.8.1
diff --git a/.sops.yaml b/.sops.yaml
index dc76f60..588cb69 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,5 +1,8 @@
 creation_rules:
-  # Here we have
-  # - Jacques key-id: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
-  - age:
-      age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x,
+  # Using a single-key group to be able to use per-key comments,
+  # see https://github.com/getsops/sops/issues/845#issuecomment-1364109772
+  - key_groups:
+    - age:
+      - age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x # Jacques
+      - age1h7d5y4w370whuawk5jxz8zv320u766mzhvlg2n6gh6hxvqmxg4psfpr03e # Jonathan
+      - age1nma4n6pxaywl39cndnu852vx0xs0vh5stcc3qtasdt89u4dqrussvjk5fj # github-repo
diff --git a/scripts/updatekeys.sh b/scripts/updatekeys.sh
new file mode 100755
index 0000000..43e2f9d
--- /dev/null
+++ b/scripts/updatekeys.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+find . -name "*.enc.*" -exec sops updatekeys -y {} \;