diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index efb687d..9ac0471 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -176,19 +176,202 @@ spec:
         - name: NOTIFICATIONS_SMTP_ENCRYPTION
           value: "ssl"
 
-        # Storage configuration
-        - name: GATEWAY_STORAGE_USERS_MOUNT_ID
-          value: "/users"
-        - name: STORAGE_USERS_MOUNT_ID
-          value: "/users"
-        - name: STORAGE_USERS_SERVICE_ACCOUNT_ID
-          value: "599fd884-c9bb-45fa-b347-cf2c910d546a"
-        - name: STORAGE_USERS_SERVICE_ACCOUNT_SECRET
-          value: "v6uhy3NBcZQRzS8aG4qDcQHBGTbwsMCLglBpXrvPJBc="
+        # Service account (shared across all services)
+        - name: OC_SERVICE_ACCOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-id
+        - name: OC_SERVICE_ACCOUNT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-secret
 
-        # IDM service user
-        - name: IDM_SERVICE_USER_PASSWORD
-          value: "v6uhy3NBcZQRzS8aG4qDcQHBGTbwsMCLglBpXrvPJBc="
+        # Storage configuration
+        - name: OC_STORAGE_MOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: storage-mount-id
+        - name: OC_GRAPH_APPLICATION_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: graph-application-id
+
+        # LDAP bind passwords
+        - name: OC_GRAPH_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: graph-ldap-bind-password
+        - name: OC_IDP_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idp-ldap-bind-password
+        - name: OC_AUTH_BASIC_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: ldap-bind-password
+        - name: OC_USERS_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: ldap-bind-password
+        - name: OC_GROUPS_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: ldap-bind-password
+
+        # IDM service user passwords
+        - name: OC_IDM_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-admin-password
+        - name: OC_IDM_IDM_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-idm-password
+        - name: OC_IDM_REVA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-reva-password
+        - name: OC_IDM_IDP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-idp-password
+
+        # Other service secrets
+        - name: OC_COLLABORATION_WOPI_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: collaboration-wopi-secret
+        - name: OC_THUMBNAILS_TRANSFER_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: thumbnails-transfer-secret
+
+        # Service-specific environment variables (for direct override)
+        - name: GRAPH_APPLICATION_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: graph-application-id
+        - name: GRAPH_IDENTITY_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: graph-ldap-bind-password
+        - name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-id
+        - name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-secret
+        - name: IDP_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idp-ldap-bind-password
+        - name: IDM_SERVICE_USER_PASSWORDS_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-admin-password
+        - name: IDM_SERVICE_USER_PASSWORDS_IDM_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-idm-password
+        - name: IDM_SERVICE_USER_PASSWORDS_REVA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-reva-password
+        - name: IDM_SERVICE_USER_PASSWORDS_IDP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: idm-idp-password
+        - name: COLLABORATION_WOPI_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: collaboration-wopi-secret
+        - name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-id
+        - name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-secret
+        - name: STORAGE_USERS_MOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: storage-mount-id
+        - name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-id
+        - name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-secret
+        - name: GATEWAY_STORAGE_REGISTRY_STORAGE_USERS_MOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: storage-mount-id
+        - name: AUTH_BASIC_AUTH_PROVIDERS_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: ldap-bind-password
+        - name: USERS_DRIVERS_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: ldap-bind-password
+        - name: GROUPS_DRIVERS_LDAP_BIND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: ldap-bind-password
+        - name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-id
+        - name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: service-account-secret
+        - name: THUMBNAILS_THUMBNAIL_TRANSFER_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-config-secrets
+              key: thumbnails-transfer-secret
 
         # Demo users disabled (use OIDC only)
         - name: IDM_CREATE_DEMO_USERS