diff --git a/apps/templates/helm-vault.yaml b/apps/templates/helm-vault.yaml
index cc460a3..3478eae 100644
--- a/apps/templates/helm-vault.yaml
+++ b/apps/templates/helm-vault.yaml
@@ -15,51 +15,8 @@ spec:
       repoURL: https://helm.releases.hashicorp.com
       targetRevision: 0.28.1
       helm:
-        values: |
-          global:
-            enabled: true
-            tlsDisable: false
-          injector:
-            enabled: true
-          server:
-            extraEnvironmentVars:
-                VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
-                VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
-                VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
-            volumes:
-                - name: userconfig-vault-ha-tls
-                  secret:
-                  defaultMode: 420
-                  secretName: vault-ha-tls
-            volumeMounts:
-                - mountPath: /vault/userconfig/vault-ha-tls
-                  name: userconfig-vault-ha-tls
-                  readOnly: true
-            standalone:
-                enabled: false
-            affinity: ""
-            ha:
-                enabled: true
-                replicas: 3
-                raft:
-                  enabled: true
-                  setNodeId: true
-                  config: |
-                      cluster_name = "vault-integrated-storage"
-                      ui = true
-                      listener "tcp" {
-                        tls_disable = 0
-                        address = "[::]:8200"
-                        cluster_address = "[::]:8201"
-                        tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
-                        tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
-                        tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
-                      }
-                      storage "raft" {
-                        path = "/vault/data"
-                      }
-                      disable_mlock = true
-                      service_registration "kubernetes" {}
+        valueFiles:
+        - overrides.yaml
 
   destination:
     server: https://kubernetes.default.svc
diff --git a/apps/templates/overrides.yaml b/apps/templates/overrides.yaml
new file mode 100644
index 0000000..7ff621d
--- /dev/null
+++ b/apps/templates/overrides.yaml
@@ -0,0 +1,44 @@
+global:
+   enabled: true
+   tlsDisable: false
+injector:
+   enabled: true
+server:
+   extraEnvironmentVars:
+      VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
+      VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
+      VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
+   volumes:
+      - name: userconfig-vault-ha-tls
+        secret:
+         defaultMode: 420
+         secretName: vault-ha-tls
+   volumeMounts:
+      - mountPath: /vault/userconfig/vault-ha-tls
+        name: userconfig-vault-ha-tls
+        readOnly: true
+   standalone:
+      enabled: false
+   affinity: ""
+   ha:
+      enabled: true
+      replicas: 3
+      raft:
+         enabled: true
+         setNodeId: true
+         config: |
+            cluster_name = "vault-integrated-storage"
+            ui = true
+            listener "tcp" {
+               tls_disable = 0
+               address = "[::]:8200"
+               cluster_address = "[::]:8201"
+               tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
+               tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
+               tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
+            }
+            storage "raft" {
+               path = "/vault/data"
+            }
+            disable_mlock = true
+            service_registration "kubernetes" {}