diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..fde2173
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,13 @@
+creation_rules:
+
+  # encrypt secrets files
+  - path_regex: \.local\.dec\.yaml$
+    encrypted_regex: '^(.*)$'
+    age: 
+      - age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+
+  # encrypt secrets files
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: 
+      - age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
diff --git a/README.md b/README.md
index 83b714b..c500441 100644
--- a/README.md
+++ b/README.md
@@ -148,6 +148,12 @@ su -s /bin/bash www-data -c "php occ maintenance:repair --include-expensive"
 - All kustomizations can be executed using vscode task `Kustomize - Build & Deploy - Selected File`.
 - Helm charts can be deployed using vscode task `Apply App`.
 
+**Required encrypted filed on repo:**
+
+``` bash
+sops -e ./deploy/whiteboard/whiteboard-secrets.dec.yaml ./deploy/whiteboard/whiteboard-secrets.yaml
+```
+
 ## internal logs
 
 ``` bash
@@ -163,7 +169,6 @@ kubectl exec -it ${POD_NAME} -- cat /var/www/html/data/nextcloud.log
 kubectl exec -it nextcloud-mariadb-0 -- mariadb -u nextcloud -h nextcloud-mariadb.cloud-limbosolutions-com.svc.cluster.local -p
 ```
 
-
 **Restore database:**
 
 ``` bash
diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml
index 0c0db78..249fbf2 100644
--- a/deploy/kustomization.yaml
+++ b/deploy/kustomization.yaml
@@ -6,7 +6,7 @@ resources:
   #- nextcloud
   #- backups
   #- onlyoffice
-  #- whiteboard
+  - whiteboard
 generatorOptions:
   disableNameSuffixHash: true
 
diff --git a/deploy/whiteboard/.env.d/.gitignore b/deploy/whiteboard/.env.d/.gitignore
deleted file mode 100644
index 4be88e8..0000000
--- a/deploy/whiteboard/.env.d/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-**
-!*.example
-!.gitignore
\ No newline at end of file
diff --git a/deploy/whiteboard/.env.d/whiteboard.env.example b/deploy/whiteboard/.env.d/whiteboard.env.example
deleted file mode 100644
index ba7ecde..0000000
--- a/deploy/whiteboard/.env.d/whiteboard.env.example
+++ /dev/null
@@ -1 +0,0 @@
-JWT_SECRET_KEY= ????
\ No newline at end of file
diff --git a/deploy/whiteboard/kustomization.yaml b/deploy/whiteboard/kustomization.yaml
index e3bb333..7ff70a2 100644
--- a/deploy/whiteboard/kustomization.yaml
+++ b/deploy/whiteboard/kustomization.yaml
@@ -1,15 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-secretGenerator:
-  - name: whiteboard
-    envs:
-      - ./.env.d/whiteboard.env
-
-generatorOptions:
-  disableNameSuffixHash: true
-
 resources:
+  - ./whiteboard-secrets.yaml
   - ./deployment.yaml
   - ./service.yaml
   - ./middlewares.yaml
diff --git a/deploy/whiteboard/whiteboard-secrets.yaml b/deploy/whiteboard/whiteboard-secrets.yaml
new file mode 100644
index 0000000..fa9e1b5
--- /dev/null
+++ b/deploy/whiteboard/whiteboard-secrets.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: whiteboard
+type: Opaque
+stringData:
+    JWT_SECRET_KEY: ENC[AES256_GCM,data:36WwQQzfpQcR2YOZELt49UVvmd+/TuEDKJ8Q8D/W7Ivy6QwVFch0cxeISfY=,iv:JMjFvRUuXpE3aEILhGkWUZT38z0EsQ33MUDJow8S3kA=,tag:Y5VINENyAxqxbLE45XsHJQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYU0JXcWtXOHc4amJmcXRC
+            eXdSQi9DenowZm03WHg3aHRkRHRJN1k0dVNzClVSWDNUZGhBdHVRaGI2UmdsZnZs
+            WVdzQytENjR0ZjdrZSsvNTZOS0ZZS3MKLS0tIHRCTUdabFM0WWpWSW1ieFFuRjRy
+            RVk5M1RvT1k3LzJmRHJMTlU5d0hQNjAKycFfu4WkePIIqj0aIjivwvdoZuGEKqTa
+            8xjiIB6Vukyg9mJNQLPb2Mv1/ZASqhCn5TSXnMknFIKJALAt+oXtBg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-07-16T19:38:13Z"
+    mac: ENC[AES256_GCM,data:PKw9lBAGDMzPZR3I4AcSME3+b27aUymK6LKp5gXK/YRAy49PfiCbWe3ZDkDyiTMyGswct3xkg7F5MBoqb4rEOAStkGFAYux0Eri0PIJfq2gSTKaJuggQYu7InKC6XSNFrweDRnpvL0b9kBnmWMKI5i8kFT15VizFkrAHi5xuKLY=,iv:zvhIK2hVFi5g44M/uVpP4bXNcfSsITLoQ8leNvRGuSQ=,tag:IP2RAeOJjGhS3IedG8jsGQ==,type:str]
+    version: 3.13.1