diff --git a/stalwart/templates/configmap.yaml b/stalwart/templates/configmap.yaml
index 34ba61b..14cb689 100644
--- a/stalwart/templates/configmap.yaml
+++ b/stalwart/templates/configmap.yaml
@@ -80,6 +80,10 @@ data:
     type = "internal"
     store = "rocksdb"
 
+    [authentication.fallback-admin]
+    user = "%{env:STALWART_ADMIN_USER}%"
+    secret = "%{env:STALWART_ADMIN_PASSWORD}%"
+
     [tracer.log]
     type = "log"
     enable = true
diff --git a/stalwart/templates/deployment.yaml b/stalwart/templates/deployment.yaml
index 6b3a07e..40179d9 100644
--- a/stalwart/templates/deployment.yaml
+++ b/stalwart/templates/deployment.yaml
@@ -22,6 +22,17 @@ spec:
       - name: stalwart
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
+        env:
+        - name: STALWART_ADMIN_USER
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "stalwart.fullname" . }}-admin
+              key: user
+        - name: STALWART_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "stalwart.fullname" . }}-admin
+              key: pw
         livenessProbe:
           httpGet:
             path: /healthz/live
diff --git a/stalwart/templates/external-secret.yaml b/stalwart/templates/external-secret.yaml
new file mode 100644
index 0000000..2f476c5
--- /dev/null
+++ b/stalwart/templates/external-secret.yaml
@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: {{ include "stalwart.fullname" . }}-admin
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stalwart.labels" . | nindent 4 }}
+spec:
+  refreshInterval: "15m"
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: {{ include "stalwart.fullname" . }}-admin
+    creationPolicy: Owner
+  data:
+  - secretKey: user
+    remoteRef:
+      key: kv/stalwart/stalwartadmin
+      property: user
+  - secretKey: pw
+    remoteRef:
+      key: kv/stalwart/stalwartadmin
+      property: pw