diff --git a/platform/staging/forgejo.yaml b/platform/staging/forgejo.yaml
index 8a9e4a9..d7953af 100644
--- a/platform/staging/forgejo.yaml
+++ b/platform/staging/forgejo.yaml
@@ -67,10 +67,12 @@ spec:
         - name: SSO
           provider: 'openidConnect'
           autoDiscoverUrl: https://dex.cloudlab.khuedoan.com/.well-known/openid-configuration
-          existingSecret: forgejo-oauth
+          key: vault:secret/data/forgejo/oauth#key
+          secret: vault:secret/data/forgejo/oauth#secret
       admin:
         email: admin@cloudlab.khuedoan.com
-        existingSecret: forgejo-admin
+        username: forgejo_admin
+        password: vault:secret/data/forgejo/admin#password
       podAnnotations:
         "istio.io/dataplane-mode": "ambient"
     ingress:
diff --git a/settings.yaml b/settings.yaml
index eeee373..aad550e 100644
--- a/settings.yaml
+++ b/settings.yaml
@@ -12,3 +12,12 @@ secrets:
       description: |
         Enter Cloudflare API token:
         (Generate it from https://dash.cloudflare.com -> Manage account -> Account API tokens)
+  secret/forgejo/admin:
+    password:
+      type: random
+  # TODO maybe centralize to Dex
+  secret/forgejo/oauth:
+    key:
+      type: random
+    secret:
+      type: random