diff --git a/argocd/kustomization.yaml b/argocd/kustomization.yaml
index 679bfc5..c316bb7 100644
--- a/argocd/kustomization.yaml
+++ b/argocd/kustomization.yaml
@@ -8,6 +8,7 @@ namespace: argocd
 resources:
 - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v2.14.2/manifests/install.yaml
 - ingress.yaml
+- oidc-secret.yaml
 
 patches:
   - target:
diff --git a/argocd/oidc-secret.yaml b/argocd/oidc-secret.yaml
new file mode 100644
index 0000000..9710bf6
--- /dev/null
+++ b/argocd/oidc-secret.yaml
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: argocd-oidc-secret
+  namespace: argocd
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: argocd-secret
+    creationPolicy: Merge
+  data:
+    - secretKey: oidc.authentik.clientSecret
+      remoteRef:
+        key: kv/argocd-oidc
+        property: client_secret
diff --git a/argocd/webhook-es.yaml b/argocd/webhook-es.yaml
index 07e7d1c..f05e6e1 100644
--- a/argocd/webhook-es.yaml
+++ b/argocd/webhook-es.yaml
@@ -10,16 +10,12 @@ spec:
     kind: ClusterSecretStore
   target:
     template:
+      type: kubernetes.io/dockerconfigjson
       data:
-        webhook.github.secret: "{{ .webhook_secret | toString }}"
-        oidc.authentik.clientSecret: "{{ .oidc_client_secret | toString }}"
+        webhook.github.secret: "{{ .mysecret | toString }}"
     name: argocd-secret
-    creationPolicy: Merge
+    creationPolicy: Owner
   data:
-  - secretKey: webhook_secret
+  - secretKey: mysecret
     remoteRef:
       key: github_secret
-  - secretKey: oidc_client_secret
-    remoteRef:
-      key: kv/argocd-oidc
-      property: client_secret