diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml
index 63e31f2..539e938 100644
--- a/apps/templates/authentik-helm.yaml
+++ b/apps/templates/authentik-helm.yaml
@@ -24,7 +24,12 @@ spec:
             bootstrap_password: ""
             bootstrap_token: ""
             postgresql:
+              host: authentik-postgres-rw
+              name: authentik
+              user: authentik
               password: ""
+            existingSecret:
+              secretName: authentik-secrets
           global:
             env:
               - name: AUTHENTIK_SECRET_KEY
@@ -42,6 +47,11 @@ spec:
                   secretKeyRef:
                     name: authentik-secrets
                     key: bootstrap_token
+              - name: AUTHENTIK_POSTGRESQL__PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: authentik-postgres-credentials
+                    key: password
           server:
             ingress:
               enabled: true
@@ -55,16 +65,7 @@ spec:
                   hosts:
                     - authentik.rubenhensen.nl
           postgresql:
-            enabled: true
-            auth:
-              password: ""
-              postgresPassword: ""
-            primary:
-              persistence:
-                storageClass: longhorn
-                size: 8Gi
-              existingSecret: authentik-secrets
-              existingSecretKey: postgres_password
+            enabled: false
           redis:
             enabled: true
             master:
diff --git a/authentik/external-secret.yaml b/authentik/external-secret.yaml
index b59d496..4534fdd 100644
--- a/authentik/external-secret.yaml
+++ b/authentik/external-secret.yaml
@@ -23,7 +23,25 @@ spec:
       remoteRef:
         key: kv/authentik
         property: bootstrap_token
-    - secretKey: postgres_password
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: authentik-postgres-credentials
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: authentik-postgres-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: kv/authentik
+        property: postgres_user
+    - secretKey: password
       remoteRef:
         key: kv/authentik
         property: postgres_password
diff --git a/authentik/postgresql-cluster.yaml b/authentik/postgresql-cluster.yaml
new file mode 100644
index 0000000..a791cc6
--- /dev/null
+++ b/authentik/postgresql-cluster.yaml
@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: authentik-postgres
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  bootstrap:
+    initdb:
+      database: authentik
+      owner: authentik
+      secret:
+        name: authentik-postgres-credentials
+  storage:
+    storageClass: longhorn
+    size: 8Gi