diff --git a/applications/10-external-secrets/eso-crds/eso.yaml b/applications/10-external-secrets/eso-crds/eso.yaml
new file mode 100644
index 0000000..20d7320
--- /dev/null
+++ b/applications/10-external-secrets/eso-crds/eso.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: "https://charts.external-secrets.io"
+    chart: "external-secrets"
+    targetRevision: "0.19.2"
+    helm:
+      installCRDs: true
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/applications/10-external-secrets/external-secrets.yaml b/applications/10-external-secrets/external-secrets.yaml
new file mode 100644
index 0000000..16d3cad
--- /dev/null
+++ b/applications/10-external-secrets/external-secrets.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+    - list:
+        elements:
+          - name: eso-crds
+            path: applications/10-external-secrets/eso-crds
+            wave: 1
+  template:
+    metadata:
+      name: '{{.name}}'
+    spec:
+      project: default
+      source:
+        repoURL: 'https://repobase.net/j/home-server.git'
+        targetRevision: HEAD
+        path: '{{.path}}'
+      destination:
+        server: 'https://kubernetes.default.svc'
+        namespace: database
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - SyncWave={{.wave}}
diff --git a/deploy/server.yaml b/deploy/server.yaml
index 1c1ca6e..98f4168 100644
--- a/deploy/server.yaml
+++ b/deploy/server.yaml
@@ -2,29 +2,34 @@
 apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
 metadata:
-  name: home-server-applications
+  name: deploy-hxme
   namespace: argocd
 spec:
   goTemplate: true
   generators:
     - list:
         elements:
-          - name: replicator
+          - name: deploy-eso
+            path: applications/10-external-secrets
+            namespace: home-server
+            wave: 1
+
+          - name: deploy-replicator
             path: applications/10-replicator
             namespace: home-server
             wave: 1
 
-          - name: domain-names
+          - name: deploy-dns
             path: applications/20-domain-names
             namespace: home-server
             wave: 1
 
-          - name: databases
+          - name: deploy-databases
             path: applications/30-databases
             namespace: database
             wave: 2
 
-          - name: authentik-deploy
+          - name: deploy-authentik
             path: applications/40-authentik
             namespace: home-server
             wave: 3