diff --git a/platform/staging/dex.yaml b/platform/staging/dex.yaml
index 510dbd7..8a734fc 100644
--- a/platform/staging/dex.yaml
+++ b/platform/staging/dex.yaml
@@ -10,6 +10,47 @@ spec:
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
+metadata:
+  name: dex-secrets
+  namespace: flux-system
+spec:
+  interval: 30m
+  dependsOn:
+    - name: platform-namespaces
+    - name: vault
+    - name: vault-secrets-webhook
+  releaseName: dex-secrets
+  targetNamespace: dex
+  install:
+    createNamespace: true
+  chart:
+    spec:
+      chart: app-template
+      version: 4.6.0
+      sourceRef:
+        kind: HelmRepository
+        name: app-template
+  values:
+    rawResources:
+      dex-secrets:
+        apiVersion: v1
+        kind: Secret
+        forceRename: dex-secrets
+        annotations:
+          vault.security.banzaicloud.io/vault-addr: http://vault.vault.svc.cluster.local:8200
+          vault.security.banzaicloud.io/vault-role: default
+          vault.security.banzaicloud.io/vault-path: kubernetes
+        spec:
+          stringData:
+            # Keep Vault resolution on the Secret object. Inline vault: env values
+            # make Dex depend on pod mutation, and that path breaks here because
+            # the webhook cannot use the K3s image mirror config for registry lookups.
+            ADMIN_PASSWORD_HASH: vault:secret/data/dex/auth#ADMIN_PASSWORD_HASH
+            KHUEDOAN_PASSWORD_HASH: vault:secret/data/dex/auth#KHUEDOAN_PASSWORD_HASH
+            FORGEJO_CLIENT_SECRET: vault:secret/data/forgejo/oauth#secret
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: dex
   namespace: flux-system
@@ -17,6 +58,7 @@ spec:
   interval: 3m
   dependsOn:
     - name: platform-namespaces
+    - name: dex-secrets
   chart:
     spec:
       chart: dex
@@ -32,10 +74,9 @@ spec:
     image:
       repository: registry.registry.svc.cluster.local/vendor/images/dexidp/dex
       tag: v2.43.1
-    env:
-      ADMIN_PASSWORD_HASH: vault:secret/data/dex/auth#ADMIN_PASSWORD_HASH
-      KHUEDOAN_PASSWORD_HASH: vault:secret/data/dex/auth#KHUEDOAN_PASSWORD_HASH
-      FORGEJO_CLIENT_SECRET: vault:secret/data/forgejo/oauth#secret
+    envFrom:
+      - secretRef:
+          name: dex-secrets
     config:
       issuer: https://dex.staging.khuedoan.com
       storage:
diff --git a/platform/staging/forgejo.yaml b/platform/staging/forgejo.yaml
index 95028fa..8112204 100644
--- a/platform/staging/forgejo.yaml
+++ b/platform/staging/forgejo.yaml
@@ -9,6 +9,57 @@ spec:
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
+metadata:
+  name: forgejo-secrets
+  namespace: flux-system
+spec:
+  interval: 30m
+  dependsOn:
+    - name: platform-namespaces
+    - name: vault
+    - name: vault-secrets-webhook
+  releaseName: forgejo-secrets
+  targetNamespace: forgejo
+  install:
+    createNamespace: true
+  chart:
+    spec:
+      chart: app-template
+      version: 4.6.0
+      sourceRef:
+        kind: HelmRepository
+        name: app-template
+  values:
+    rawResources:
+      forgejo-admin:
+        apiVersion: v1
+        kind: Secret
+        forceRename: forgejo-admin
+        annotations:
+          vault.security.banzaicloud.io/vault-addr: http://vault.vault.svc.cluster.local:8200
+          vault.security.banzaicloud.io/vault-role: default
+          vault.security.banzaicloud.io/vault-path: kubernetes
+        spec:
+          stringData:
+            username: forgejo_admin
+            password: vault:secret/data/forgejo/admin#password
+      forgejo-oauth:
+        apiVersion: v1
+        kind: Secret
+        forceRename: forgejo-oauth
+        annotations:
+          vault.security.banzaicloud.io/vault-addr: http://vault.vault.svc.cluster.local:8200
+          vault.security.banzaicloud.io/vault-role: default
+          vault.security.banzaicloud.io/vault-path: kubernetes
+        spec:
+          stringData:
+            # Forgejo expects a Kubernetes Secret for OAuth bootstrap. Creating
+            # it explicitly keeps startup independent from pod-time Vault mutation.
+            key: forgejo
+            secret: vault:secret/data/forgejo/oauth#secret
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: forgejo
   namespace: flux-system
@@ -18,6 +69,7 @@ spec:
     - name: dex
     - name: vault
     - name: vault-secrets-webhook
+    - name: forgejo-secrets
   chart:
     spec:
       chart: forgejo
@@ -32,10 +84,6 @@ spec:
   values:
     strategy:
       type: Recreate
-    deployment:
-      env:
-        - name: FORGEJO_OAUTH_SECRET
-          value: vault:secret/data/forgejo/oauth#secret
     gitea:
       config:
         database:
@@ -74,17 +122,11 @@ spec:
       oauth:
         - name: SSO
           provider: "openidConnect"
-          # Use the in-cluster Dex service for bootstrap because the single-node
-          # staging cluster cannot reliably hairpin through the public gateway.
-          autoDiscoverUrl: http://dex.dex.svc.cluster.local:5556/.well-known/openid-configuration
-          key: forgejo
-          # Can't use Vault syntax directly here, because it will be templated
-          # into a secret, so we need to define a separate environment variable
-          secret: ${FORGEJO_OAUTH_SECRET}
+          autoDiscoverUrl: https://dex.staging.khuedoan.com/.well-known/openid-configuration
+          existingSecret: forgejo-oauth
       admin:
         email: admin@cloudlab.khuedoan.com
-        username: forgejo_admin
-        password: vault:secret/data/forgejo/admin#password
+        existingSecret: forgejo-admin
       podAnnotations:
         "istio.io/dataplane-mode": "ambient"
     httpRoute:
diff --git a/platform/staging/vault.yaml b/platform/staging/vault.yaml
index 719ed55..fca3f2a 100644
--- a/platform/staging/vault.yaml
+++ b/platform/staging/vault.yaml
@@ -47,6 +47,8 @@ spec:
   values:
     env:
       VAULT_ADDR: http://vault.vault.svc.cluster.local:8200
+    # TODO fail fast
+    # podsFailurePolicy: Fail
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease