diff --git a/default/paperless.yaml b/default/paperless.yaml
index 947c92f..66932e1 100644
--- a/default/paperless.yaml
+++ b/default/paperless.yaml
@@ -46,10 +46,30 @@ spec:
               value: '{"invalidate_digital_signatures": true}'
             - name: PAPERLESS_DBHOST
               value: postgresql.haven
+            - name: PAPERLESS_DBNAME
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_DBNAME
+            - name: PAPERLESS_DBUSER
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_DBUSER
+            - name: PAPERLESS_DBPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_DBPASSWORD
             - name: PAPERLESS_REDIS
               value: "redis://redis.haven:6379"
             - name: PAPERLESS_PORT
               value: "8000"
+            - name: PAPERLESS_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-secret
+                  key: PAPERLESS_SECRET_KEY
           ports:
             - containerPort: 8000
               name: paperless-port
diff --git a/default/haven-notify.yaml b/infra/haven-notify.yaml
similarity index 90%
rename from default/haven-notify.yaml
rename to infra/haven-notify.yaml
index f4dab22..ab4a11e 100644
--- a/default/haven-notify.yaml
+++ b/infra/haven-notify.yaml
@@ -2,11 +2,16 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: haven-notify
-  namespace: default
+  namespace: infra
   labels:
     app: haven-notify
 spec:
-  replicas: 1
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
   selector:
     matchLabels:
       app: haven-notify
@@ -52,7 +57,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: haven-notify
-  namespace: default
+  namespace: infra
 spec:
   selector:
     app: haven-notify
@@ -65,7 +70,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: haven-notify
-  namespace: default
+  namespace: infra
 spec:
   ingressClassName: nginx
   rules:
diff --git a/secrets/discord-webhook.yaml b/secrets/discord-webhook.yaml
new file mode 100644
index 0000000..52f5414
--- /dev/null
+++ b/secrets/discord-webhook.yaml
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: discord-webhook, namespace: infra }
+spec:
+  refreshInterval: 1h
+  target:
+    name: discord-webhook
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        HAVEN_WEBHOOK_URL: "{{ .HAVEN_WEBHOOK_URL }}"
+  data:
+    - secretKey: HAVEN_WEBHOOK_URL
+      remoteRef:
+        {
+          key: afd065bd-be8f-4e3c-a06e-e9d3089cb8f7,
+          property: HAVEN_WEBHOOK_URL,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
diff --git a/secrets/paperless.yaml b/secrets/paperless.yaml
index 641c8df..be8b00f 100644
--- a/secrets/paperless.yaml
+++ b/secrets/paperless.yaml
@@ -12,6 +12,7 @@ spec:
         PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
         PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
         PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
+        PAPERLESS_SECRET_KEY: "{{ .PAPERLESS_SECRET_KEY }}"
   data:
     - secretKey: PAPERLESS_DBNAME
       remoteRef:
@@ -37,3 +38,11 @@ spec:
         }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_SECRET_KEY
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_SECRET_KEY,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }