diff --git a/nextcloud/application.yaml b/nextcloud/application.yaml
index 1ce2bad..5556f7b 100644
--- a/nextcloud/application.yaml
+++ b/nextcloud/application.yaml
@@ -196,7 +196,7 @@ spec:
             - name: OBJECTSTORE_S3_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: nextcloud-imported-secrets
+                  name: nextcloud-s3
                   key: OBJECTSTORE_S3_SECRET
           ports:
             - containerPort: 80
@@ -337,3 +337,13 @@ data:
         'oidc_login_skip_proxy' => false,
         'oidc_login_code_challenge_method' => '',
     );
+---
+apiVersion: codemowers.cloud/v1beta1
+kind: SecretClaim
+metadata:
+  name: nextcloud-admin-secrets
+spec:
+  size: 32
+  mapping:
+    - key: password
+      value: "%(plaintext)s"
diff --git a/nextcloud/kustomization.yaml b/nextcloud/kustomization.yaml
new file mode 100644
index 0000000..3d4b0b0
--- /dev/null
+++ b/nextcloud/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: nextcloud
+
+resources:
+- ssh://git@git.k-space.ee/secretspace/kube/nextcloud
+- ./application.yaml
+- ./mariadb.yaml
diff --git a/nextcloud/mariadb.yml b/nextcloud/mariadb.yaml
similarity index 100%
rename from nextcloud/mariadb.yml
rename to nextcloud/mariadb.yaml