diff --git a/helm/templates/secret-workloads.yaml b/helm/templates/secret-workloads.yaml
new file mode 100644
index 00000000..61f6cb73
--- /dev/null
+++ b/helm/templates/secret-workloads.yaml
@@ -0,0 +1,51 @@
+{{/*
+Workload Secrets referenced by the backend Deployment, worker Deployment, and
+migration Job. These hold the credentials the application pods consume directly:
+  - <fullname>-db    (key: postgres-password) — only when db.type == "postgres"
+  - <fullname>-minio (key: secret-key)        — only when minio.enabled
+
+Gated identically to the secretKeyRef usages so `helm template` renders coherently
+with default values. Values are seeded from values.yaml (db.postgres.password,
+minio.secretKey) so they stay in sync with the bundled subcharts; when unset they
+fall back to an existing in-cluster value (idempotent on upgrade) or a fresh random,
+so no install-time --set wiring is required.
+*/}}
+{{- if eq .Values.db.type "postgres" }}
+{{- $dbSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-db" (include "open-git.fullname" .)) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "open-git.fullname" . }}-db
+  labels:
+    {{- include "open-git.labels" . | nindent 4 }}
+    app.kubernetes.io/component: db
+type: Opaque
+data:
+  {{- if .Values.db.postgres.password }}
+  postgres-password: {{ .Values.db.postgres.password | b64enc | quote }}
+  {{- else if and $dbSecret (index $dbSecret.data "postgres-password") }}
+  postgres-password: {{ index $dbSecret.data "postgres-password" | quote }}
+  {{- else }}
+  postgres-password: {{ randAlphaNum 32 | b64enc | quote }}
+  {{- end }}
+{{- end }}
+{{- if .Values.minio.enabled }}
+{{- $minioSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-minio" (include "open-git.fullname" .)) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "open-git.fullname" . }}-minio
+  labels:
+    {{- include "open-git.labels" . | nindent 4 }}
+    app.kubernetes.io/component: minio
+type: Opaque
+data:
+  {{- if .Values.minio.secretKey }}
+  secret-key: {{ .Values.minio.secretKey | b64enc | quote }}
+  {{- else if and $minioSecret (index $minioSecret.data "secret-key") }}
+  secret-key: {{ index $minioSecret.data "secret-key" | quote }}
+  {{- else }}
+  secret-key: {{ randAlphaNum 32 | b64enc | quote }}
+  {{- end }}
+{{- end }}