diff --git a/owntracks/recorder.yaml b/owntracks/recorder.yaml
index f619e44..fc98032 100644
--- a/owntracks/recorder.yaml
+++ b/owntracks/recorder.yaml
@@ -45,11 +45,33 @@ spec:
     requests:
       storage: 1Gi
 ---
+# ExternalSecret for OwnTracks Recorder password
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: owntracks-mqtt-credentials
+  namespace: owntracks
+spec:
+  refreshInterval: "15m"
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: owntracks-mqtt-password
+    creationPolicy: Owner
+  data:
+    - secretKey: password
+      remoteRef:
+        key: kv/mqtt
+        property: password
+
+---
 # Deployment for OwnTracks Recorder
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: otrecorder
+  namespace: owntracks
 spec:
   replicas: 1
   selector:
@@ -71,9 +93,12 @@ spec:
         - name: OTR_PORT
           value: "1883"
         - name: OTR_USER
-          value: "user"
+          value: "ruben"
         - name: OTR_PASS
-          value: "pass"
+          valueFrom:
+            secretKeyRef:
+              name: owntracks-mqtt-password
+              key: password
         volumeMounts:
         - name: config
           mountPath: /config
@@ -243,4 +268,4 @@ spec:
           service:
             name: mosquitto
             port:
-              number: 8883
\ No newline at end of file
+              number: 8883