diff --git a/cluster/external-secrets.yaml b/cluster/external-secrets.yaml
index f123788..98c1634 100644
--- a/cluster/external-secrets.yaml
+++ b/cluster/external-secrets.yaml
@@ -17,6 +17,9 @@ spec:
     path: cluster/external-secrets
     repoURL: https://github.com/rblundon/homelab.git
     targetRevision: HEAD
+    helm:
+      valueFiles:
+        - values-hub.yaml
   syncPolicy:
     automated:
       prune: true
diff --git a/cluster/external-secrets/values-hub.yaml b/cluster/external-secrets/values-hub.yaml
new file mode 100644
index 0000000..b0deb3f
--- /dev/null
+++ b/cluster/external-secrets/values-hub.yaml
@@ -0,0 +1,30 @@
+# https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/values.yaml
+
+external-secrets:
+  enabled: false # Default: true
+
+resources:
+   requests:
+     cpu: 10m
+     memory: 32Mi
+
+# -- if true, the operator will process cluster external secret. Else, it will ignore them.
+processClusterExternalSecret: true
+
+# -- if true, the operator will process cluster push secret. Else, it will ignore them.
+processClusterPushSecret: false #true
+
+# -- if true, the operator will process cluster store. Else, it will ignore them.
+processClusterStore: false #true
+
+# -- if true, the operator will process push secret. Else, it will ignore them.
+processPushSecret: false #true
+
+webhook:
+  # -- Specifies whether a webhook deployment be created. If set to false, crds.conversion.enabled should also be set to false otherwise the kubeapi will be hammered because the conversion is looking for a webhook endpoint.
+  create: false #true
+
+certController:
+  # -- Specifies whether a certificate controller deployment be created.
+  create: false #true
+
diff --git a/cluster/external-secrets/values.yaml b/cluster/external-secrets/values.yaml
deleted file mode 100644
index ead2ccd..0000000
--- a/cluster/external-secrets/values.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-# https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/values.yaml
-
-external-secrets:
-  enabled: false # Default: true