diff --git a/kubernetes/apps/default/renamarr/app/config/config.yml b/kubernetes/apps/default/renamarr/app/config/config.yml
index ae2cb4528..5625227dd 100644
--- a/kubernetes/apps/default/renamarr/app/config/config.yml
+++ b/kubernetes/apps/default/renamarr/app/config/config.yml
@@ -1,7 +1,7 @@
 sonarr:
   - name: tv
     url: https://sonarr.default.svc.cluster.local.:8080
-    api_key: !env_var SONARR_API_KEY
+    api_key: ${SONARR_API_KEY}
     renamarr:
       enabled: true
       hourly_job: false
@@ -12,7 +12,7 @@ sonarr:
 radarr:
   - name: radarr
     url: https://radarr.default.svc.cluster.local.:8080
-    api_key: !env_var RADARR_API_KEY
+    api_key: ${RADARR_API_KEY}
     renamarr:
       enabled: true
       hourly_job: false
diff --git a/kubernetes/apps/default/renamarr/app/kustomization.yaml b/kubernetes/apps/default/renamarr/app/kustomization.yaml
index bfad795b1..e0dcf95ee 100644
--- a/kubernetes/apps/default/renamarr/app/kustomization.yaml
+++ b/kubernetes/apps/default/renamarr/app/kustomization.yaml
@@ -2,7 +2,6 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: default
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
@@ -12,5 +11,3 @@ configMapGenerator:
       - ./config/config.yml
 generatorOptions:
   disableNameSuffixHash: true
-  annotations:
-    kustomize.toolkit.fluxcd.io/substitute: disabled
diff --git a/kubernetes/apps/default/renamarr/dependencies/externalsecret.yaml b/kubernetes/apps/default/renamarr/dependencies/externalsecret.yaml
new file mode 100644
index 000000000..bc8579438
--- /dev/null
+++ b/kubernetes/apps/default/renamarr/dependencies/externalsecret.yaml
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1.json
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: renamarr-flux
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: renamarr-flux-secret
+    template:
+      engineVersion: v2
+      data:
+        RADARR_API_KEY: "{{ .RADARR__API_KEY }}"
+        SONARR_API_KEY: "{{ .SONARR__API_KEY }}"
+  dataFrom:
+    - extract:
+        key: radarr
+        property: RADARR__API_KEY
+    - extract:
+        key: sonarr
+        property: SONARR__API_KEY
diff --git a/kubernetes/apps/default/renamarr/dependencies/kustomization.yaml b/kubernetes/apps/default/renamarr/dependencies/kustomization.yaml
new file mode 100644
index 000000000..c0095f1d4
--- /dev/null
+++ b/kubernetes/apps/default/renamarr/dependencies/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
diff --git a/kubernetes/apps/default/renamarr/ks.yaml b/kubernetes/apps/default/renamarr/ks.yaml
index f188ce293..bdb394466 100644
--- a/kubernetes/apps/default/renamarr/ks.yaml
+++ b/kubernetes/apps/default/renamarr/ks.yaml
@@ -3,14 +3,14 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app renamarr
+  name: &app renamarr-dependencies
   namespace: &namespace default
 spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
   interval: 1h
-  path: ./kubernetes/apps/default/renamarr/app
+  path: ./kubernetes/apps/default/renamarr/dependencies
   postBuild:
     substitute:
       APP: *app
@@ -23,3 +23,34 @@ spec:
   targetNamespace: *namespace
   timeout: 5m
   wait: false
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app renamarr
+  namespace: &namespace default
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: renamarr-dependencies
+  interval: 1h
+  path: ./kubernetes/apps/default/renamarr/app
+  postBuild:
+    substitute:
+      APP: *app
+    substituteFrom:
+      - kind: Secret
+        name: renamarr-flux-secret
+        optional: false
+  prune: true
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: home-ops-kubernetes
+    namespace: flux-system
+  targetNamespace: *namespace
+  timeout: 5m
+  wait: false