diff --git a/cluster/platform/harbor/externalsecret-pull-secret.yaml b/cluster/platform/harbor/externalsecret-pull-secret.yaml
new file mode 100644
index 0000000..02c1d50
--- /dev/null
+++ b/cluster/platform/harbor/externalsecret-pull-secret.yaml
@@ -0,0 +1,38 @@
+# ExternalSecret for fastpass cluster image pull credentials
+# Syncs from 1Password item: harbor-robot-accounts
+# Creates a docker-registry type secret for Kubernetes image pulls
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-pull-secret
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-store
+    kind: ClusterSecretStore
+  target:
+    name: harbor-pull-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "the-seas.local.mk-labs.cloud": {
+                "username": "{{ .fastpass_username }}",
+                "password": "{{ .fastpass_password }}",
+                "auth": "{{ printf "%s:%s" .fastpass_username .fastpass_password | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: fastpass_username
+      remoteRef:
+        key: harbor-robot-accounts
+        property: fastpass-cluster-username
+    - secretKey: fastpass_password
+      remoteRef:
+        key: harbor-robot-accounts
+        property: fastpass-cluster-password
diff --git a/cluster/platform/harbor/externalsecret-tekton-robot.yaml b/cluster/platform/harbor/externalsecret-tekton-robot.yaml
new file mode 100644
index 0000000..d0a0962
--- /dev/null
+++ b/cluster/platform/harbor/externalsecret-tekton-robot.yaml
@@ -0,0 +1,38 @@
+# ExternalSecret for Tekton robot account credentials
+# Syncs from 1Password item: harbor-robot-accounts
+# Creates a docker-registry type secret for Tekton pipeline authentication
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-tekton-robot
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-store
+    kind: ClusterSecretStore
+  target:
+    name: harbor-tekton-robot
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "the-seas.local.mk-labs.cloud": {
+                "username": "{{ .tekton_username }}",
+                "password": "{{ .tekton_password }}",
+                "auth": "{{ printf "%s:%s" .tekton_username .tekton_password | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: tekton_username
+      remoteRef:
+        key: harbor-robot-accounts
+        property: tekton-builder-username
+    - secretKey: tekton_password
+      remoteRef:
+        key: harbor-robot-accounts
+        property: tekton-builder-password