diff --git a/README.md b/README.md
index c041c27..64f7e6c 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@ Static routes for 193.40.103.36/30 have been added in pve nodes to make them com
 - Minio S3: `kind: MinioBucketClaim` with `class: dedicated` (NAS*: `class: external`)
 - MariaDB*: search for `mysql`, `mariadb`[^mariadb] (replaces MySQL)
 - Postgres*: hardcoded to [harbor/application.yml](harbor/application.yml)
+- Seeded secrets: `kind: SecretClaim` (generates random secret in templated format)
 
 \* External, hosted directly on [nas.k-space.ee](https://wiki.k-space.ee/en/hosting/storage)
 
diff --git a/argocd/applications/secret-claim-operator.yaml b/argocd/applications/secret-claim-operator.yaml
new file mode 100644
index 0000000..dd8b02f
--- /dev/null
+++ b/argocd/applications/secret-claim-operator.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: secret-claim-operator
+  namespace: argocd
+spec:
+  project: k-space.ee
+  source:
+    repoURL: https://github.com/codemowers/operatorlib
+    path: samples/secret-claim-operator
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: secret-claim-operator
+  syncPolicy:
+    automated:
+      prune: true
+    syncOptions:
+      - CreateNamespace=true