diff --git a/infrastructure/addons/flux-ui-secrets/kustomization.yaml b/infrastructure/addons/flux-ui-secrets/kustomization.yaml
new file mode 100644
index 0000000..189ec9a
--- /dev/null
+++ b/infrastructure/addons/flux-ui-secrets/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - weave-gitops-auth-externalsecret.yaml
diff --git a/infrastructure/addons/flux-ui-secrets/weave-gitops-auth-externalsecret.yaml b/infrastructure/addons/flux-ui-secrets/weave-gitops-auth-externalsecret.yaml
new file mode 100644
index 0000000..3a36e8b
--- /dev/null
+++ b/infrastructure/addons/flux-ui-secrets/weave-gitops-auth-externalsecret.yaml
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: weave-gitops-auth
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: doppler-hetznerterra
+    kind: ClusterSecretStore
+  target:
+    name: cluster-user-auth
+    creationPolicy: Owner
+    template:
+      type: Opaque
+      data:
+        username: "{{ .fluxUiAdminUsername }}"
+        password: "{{ .fluxUiAdminPasswordHash }}"
+  data:
+    - secretKey: fluxUiAdminUsername
+      remoteRef:
+        key: FLUX_UI_ADMIN_USERNAME
+    - secretKey: fluxUiAdminPasswordHash
+      remoteRef:
+        key: FLUX_UI_ADMIN_PASSWORD_HASH
diff --git a/infrastructure/addons/flux-ui/helmrelease-weave-gitops.yaml b/infrastructure/addons/flux-ui/helmrelease-weave-gitops.yaml
index 42c6525..7f50390 100644
--- a/infrastructure/addons/flux-ui/helmrelease-weave-gitops.yaml
+++ b/infrastructure/addons/flux-ui/helmrelease-weave-gitops.yaml
@@ -23,8 +23,8 @@ spec:
       pullPolicy: IfNotPresent
     adminUser:
       create: true
+      createSecret: false
       username: admin
-      passwordHash: "$2a$10$P/tHQ1DNFXdvX0zRGA8LPeSOyb0JXq9rP3fZ4W8HGTpLV7qHDlWhe"
     rbac:
       impersonationResourceNames:
         - admin
diff --git a/infrastructure/addons/kustomization-flux-ui-secrets.yaml b/infrastructure/addons/kustomization-flux-ui-secrets.yaml
new file mode 100644
index 0000000..4f7f4e0
--- /dev/null
+++ b/infrastructure/addons/kustomization-flux-ui-secrets.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: addon-flux-ui-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: platform
+  path: ./infrastructure/addons/flux-ui-secrets
+  dependsOn:
+    - name: addon-external-secrets-store
+  wait: false
+  timeout: 5m
+  suspend: false
diff --git a/infrastructure/addons/kustomization-flux-ui.yaml b/infrastructure/addons/kustomization-flux-ui.yaml
index bce44f9..47d2371 100644
--- a/infrastructure/addons/kustomization-flux-ui.yaml
+++ b/infrastructure/addons/kustomization-flux-ui.yaml
@@ -11,6 +11,7 @@ spec:
     name: platform
   path: ./infrastructure/addons/flux-ui
   dependsOn:
+    - name: addon-flux-ui-secrets
     - name: addon-tailscale-operator
     - name: addon-tailscale-proxyclass
   wait: false
diff --git a/infrastructure/addons/kustomization.yaml b/infrastructure/addons/kustomization.yaml
index b1d1bcc..2d4c613 100644
--- a/infrastructure/addons/kustomization.yaml
+++ b/infrastructure/addons/kustomization.yaml
@@ -11,6 +11,7 @@ resources:
   - kustomization-observability-secrets.yaml
   - kustomization-observability.yaml
   - kustomization-observability-content.yaml
+  - kustomization-flux-ui-secrets.yaml
   - kustomization-flux-ui.yaml
   - kustomization-rancher-secrets.yaml
   - kustomization-rancher.yaml