diff --git a/apps/kaneo/app-secret.yaml b/apps/kaneo/app-secret.yaml
new file mode 100644
index 0000000..933db5b
--- /dev/null
+++ b/apps/kaneo/app-secret.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: kaneo-app-secret
+  namespace: kaneo
+spec:
+  type: kv-v2
+
+  mount: secret
+  path: kaneo
+
+  destination:
+    create: true
+    name: kaneo-app-secret
+    type: Opaque
+    transformation:
+      excludeRaw: true
+      templates:
+        auth_secret:
+          text: '{{ get .Secrets "auth_secret" }}'
+
+  vaultAuthRef: kaneo
diff --git a/apps/kaneo/kustomization.yaml b/apps/kaneo/kustomization.yaml
index 95cf7ac..f534bd4 100644
--- a/apps/kaneo/kustomization.yaml
+++ b/apps/kaneo/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
+  - app-secret.yaml
   - oauth-secret.yaml
   - postgres-volume.yaml
   - postgres-cluster.yaml
diff --git a/apps/kaneo/release.yaml b/apps/kaneo/release.yaml
index 7d2378f..94ced51 100644
--- a/apps/kaneo/release.yaml
+++ b/apps/kaneo/release.yaml
@@ -58,6 +58,10 @@ spec:
       env:
         clientUrl: "https://kaneo.lumpiasty.xyz"
         disablePasswordRegistration: true
+        existingSecret:
+          enabled: true
+          name: kaneo-app-secret
+          key: auth_secret
         database:
           external:
             enabled: true
diff --git a/vault/policy/kaneo.hcl b/vault/policy/kaneo.hcl
index a68ae72..da7a032 100644
--- a/vault/policy/kaneo.hcl
+++ b/vault/policy/kaneo.hcl
@@ -1,3 +1,7 @@
 path "secret/data/authentik/kaneo" {
     capabilities = ["read"]
 }
+
+path "secret/data/kaneo" {
+    capabilities = ["read"]
+}