diff --git a/kubernetes/apps/default/invidious/app/config/config.yml b/kubernetes/apps/default/invidious/app/config/config.yml
index 498f26ad7..fcc3e4a94 100644
--- a/kubernetes/apps/default/invidious/app/config/config.yml
+++ b/kubernetes/apps/default/invidious/app/config/config.yml
@@ -414,7 +414,7 @@ feed_threads: 1
 ## Accepted values: a string
 ## Default: <none>
 ##
-#hmac_key:
+hmac_key: ${SECRET_INVIDIOUS_HMAC_KEY}
 
 ##
 ## List of video IDs where the "download" widget must be
diff --git a/kubernetes/flux/vars/cluster-secrets.sops.yaml b/kubernetes/flux/vars/cluster-secrets.sops.yaml
index 26d45ad73..34ea66c94 100644
--- a/kubernetes/flux/vars/cluster-secrets.sops.yaml
+++ b/kubernetes/flux/vars/cluster-secrets.sops.yaml
@@ -20,6 +20,7 @@ stringData:
     SECRET_GRAFANA_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:3igfeqGHygjnmJXnoiKV7W8Tm2M=,iv:Hrjh38GuRvzS4Hi69QftBhaAJ02is5B0E5h23XICpUc=,tag:O4JFVSaoTQDhf3QZPLbn1Q==,type:str]
     SECRET_HEADLAMP_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:zePwrGzHP031q94WsHA7Tbogo68=,iv:HFOngwMcgBcK8e4WikwBNmbTqxvdb6rsTFobA5EsdW8=,tag:OpGUsIk8bvQyGRNtwRBiIg==,type:str]
     SECRET_INVIDIOUS_DB_USER: ENC[AES256_GCM,data:snjA33syqy4X,iv:OF8LJSTdcIGgwAJPmS0HdCz0adsTuTwZ5zfuvJrA7fs=,tag:E4EnsKWITN4l6qnuxZ3A5g==,type:str]
+    SECRET_INVIDIOUS_HMAC_KEY: ENC[AES256_GCM,data:dNq8v26ZwiAVg8OekIgbfOfuTIP1Lv1mLXJb2ynuTc69FwzsBwToZA==,iv:3ukBQ3cHdaCFGNemvUx4du7EOZ3T/Akz7COOeGGK90A=,tag:Rry0pJoG1LdSnZVT/0+ulQ==,type:str]
     SECRET_IMMICH_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:+MEpqgBm2kK0qOq0jl/BDKEUYB4=,iv:VDU2Dggxb/qoEoDcjNrk3O5gCprEMAdRvyW/DivTo9w=,tag:Dse5KTLDLduVGT0LSIBjVA==,type:str]
     SECRET_INVIDIOUS_DB_PASSWORD: ENC[AES256_GCM,data:jmHWk/hXAb9E97CEa4w=,iv:RYnGwoCy+RyVDdKVOXWFWPB/dqF2vPlx7ofRApEAsMg=,tag:nEydKLEw6mHJetEVa+NFzQ==,type:str]
     SECRET_KOMF_MAL_CLIENT_ID: ENC[AES256_GCM,data:HuKHFrICgCj6nbcbix8u7qGeggFmmKht7Elk9dINZtE=,iv:c3mqFdFkIO9dctZ3ooPh4ajOZaY0ZudEeNWbG+lryPI=,tag:jWG2+pgkAf/XUgJyUvdrNg==,type:str]
@@ -52,8 +53,8 @@ sops:
             WG82VkdBMlNnRzBySFQzMk41cEtXSlEKBqOmq9UpO61C85+pj0ibdT31y4pmFsbm
             pTi4N0vv81kcf4ilqBU5h1gudNCb42Q2iL0eGNR4e3JzH4iaNsvnEg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-13T20:08:05Z"
-    mac: ENC[AES256_GCM,data:iSqYkW/MdDGfinlbdy3Vs8fVeowdeYS62MR3f6mUGd2cskt1mQLJY3wkLQoDkMFVm7JZWwi6Voo117MLyjdfku5IrTgJjcLsw2IxMHY44xSyOzLBEgDKXdT/hrvkxMHtCxQBAPWF72m0fcGIUR1xCpeUbTjDlve1Q6HyowxXMe0=,iv:PgO25xaJM7mFo4JnxQDiCxzEPhgaWDWmHr/ONIBixg0=,tag:CVxcqUsJcq9SJ1JPSe3qpw==,type:str]
+    lastmodified: "2023-07-05T20:29:14Z"
+    mac: ENC[AES256_GCM,data:764Iz1qP+0cjtmBZyuOOW0A1t6om8ab7YEzNRP5P8q6BY6Mpr8HOAK8rJMXq/TqTNXzzHb2XqnfItAxcv4XYuq/5mjEioAiSd9hbbh+l6WhXEw14zTSVN9IOJCo3ClWG8ybXBc8V/kbcBtZwOYM5ikVz5j2ik0304HEabhTfz3c=,iv:Z59Sptg2svDUJC2MJ/pB1FF7Dir/x4CKIlrQO+7Ut1Q=,tag:OwvfegpdvuMtYbhIQfNaGA==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3