diff --git a/navidrome/navidrome-deployment.yaml b/navidrome/navidrome-deployment.yaml
index 8d90be1..b6445f5 100644
--- a/navidrome/navidrome-deployment.yaml
+++ b/navidrome/navidrome-deployment.yaml
@@ -52,6 +52,16 @@ spec:
           value: "X-Authentik-Username"
         - name: ND_REVERSEPROXYWHITELIST
           value: "0.0.0.0/0"
+        - name: ND_SPOTIFY_ID
+          valueFrom:
+            secretKeyRef:
+              name: spotify-creds
+              key: CLIENT_ID
+        - name: ND_SPOTIFY_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: spotify-creds
+              key: CLIENT_ID
         volumeMounts:
         - name: data
           mountPath: "/data"
diff --git a/navidrome/sealed-secret.yaml b/navidrome/sealed-secret.yaml
new file mode 100644
index 0000000..4d943c1
--- /dev/null
+++ b/navidrome/sealed-secret.yaml
@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: spotify-creds
+  namespace: navidrome-ns
+spec:
+  encryptedData:
+    CLIENT_ID: AgDCmOhoW/hW2ySB8S1EvNVHZxa/KcpucT3s/0OnJWB8DcuMkA25es6+YXo39S9E1IJ8/4NIDhI6SVVp0DhtiIu4arhluW7t6Ybrv82CBatvQ6sHeK4RDiU/lrwS9TWyQUFKYUq16wOOcSQU52RPD/0KPCRdnUFZZRu3J6ZlDCDRKtDI3h3YfwFeYsJ5I2tjqKQ78AI8r5DP6Cqionz75LQq8iKL+l0KE7UQJK/qNuRhY9W3Fl+9rPSKDQM4hEB9eNwnw/aLygGxRkuPzE0/FpnhWhczQXyWpFh5uSs7p9AJ8BkCloJ1+aBxqsgcbzCUev1Y5pX0qygIxZgf2POTqfsLyYo9lHN427MQoUZgepyvgWJa7tcksUsElZUB5zBJINbYbX6JU35DEWOQ6Rmhq9kK5Wlzcghv7mjhDSvLlcdbVZZWerTbZSKspTxWYKwt4ChfIKv+/hjEu/aXH7tWi82+7IkREYHSDZ7WwkNzt1MIl36W9EBkoxuBqjaYe1jOedimDT9WDKprzaqdsVrVA2PhG179u3rFX9JIwfkEG2Q/ZLXzXj50CGEs7Y7vLGQGVH4aLd+zULEsnEDyudmgbRB++jhXPzk62upn1bGw+yb+XWUoHXAfz965+NcpX3kjovIi4c0/f7NledEphVfug4v44AENrBaJoMblkMykantjWx0dA6nTNrtoHfpdClN4l+3D+31hIH9q7b9lslWMa6FrdtzMr7O5HS3EqetzvLAKFw==
+    CLIENT_SECRET: AgB38dq30AQ5fwVJUd5DWb1s6vxobilPOVWFvZgYBkrQy0LhQmepWozzyUIZ/VNoscx3j9KhB8ojMuDGJE/CHDHTqGGViYr84WqoGQQ+cV94ef8LMCp7TR0r3TToYOS5RKerkRhL40c3toc9eLmpLu28HInN4ejLw7CS3dvLtcem1iG0D1zVllseOEkAwNDKtbnhdhBevQH1AnWYMMFvRP3qCoXwZmUKgbXdqjJdixCeL6PwtFYMiaV7NcDQG4nJUS2XxxBHiGBXNi6uNK/CEOpI0+3+/F2GXaDv2QDwUs/ZmWnBvJFvrrwnzjOt8GL6VNt3G1BzkN15DlU2FnkilkODhnj5DycMgvGb8/NDP4MqrV7cW+1DQYFr1t6Aey4xnRQZ3k85kxBB0e71wgBuJkoNqRsWpjegW4HkgZNHw4qrkqX1tg7hQbVTdWh0qaOb5P39TeumALlLvgGyuVZrXqOTyY6A0ExqIgF37NmelbSQdZ15g2glvrXJiWzZPRTlHhf/eLVnCRgS/2oBQbmTPVfLbt5BqPbXBjhRIpe/upAvNaIQMPu0ll8sXBBVtMI+TbVFNKD1LXh3XBoxs6ORaQfRWctKmLa9fDj/KMJwS56yf/TlVLyq7W3+Ko1JxsfvpMUAxijb8+M3bL+2GyidFcACXunAKlNc6aYzDAJOz95oi7Y01V7xJwCgk+okplmZskZEbhMnkvgQyzCSoNTaufbFTrzPrz3fKsAwyUT4a5YmuA==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: spotify-creds
+      namespace: navidrome-ns