diff --git a/resources/argocd-cm/env/k3s-cluster/kustomization.yaml b/infrastructures/postgresql/env/k3s-cluster/kustomization.yaml
similarity index 100%
rename from resources/argocd-cm/env/k3s-cluster/kustomization.yaml
rename to infrastructures/postgresql/env/k3s-cluster/kustomization.yaml
diff --git a/resources/argocd-cm/base/configmap.yaml b/resources/argocd-cm/base/configmap.yaml
deleted file mode 100644
index 7f1579c..0000000
--- a/resources/argocd-cm/base/configmap.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-  namespace: argocd
-data:
-  admin.enabled: "true"
-  application.instanceLabelKey: "argocd.argoproj.io/instance"
-  exec.enabled: "false"
-  server.rbac.log.enforce.enable: "false"
-  statusbadge.enabled: "false"
-  timeout.hard.reconciliation: "0s"
-  timeout.reconciliation: "180s"
-  url: "https://argocd.cluster.edward.sydney"
-  kustomize.buildOptions: "--enable-helm"
-  configManagementPlugins: |
-    - name: kustomized-helm
-      init:
-        command: ["/bin/sh", "-c"]
-        args: ["helm dependency build"]
-      generate:
-        command: [sh, -c]
-        args: ["helm template --release-name release-name . > all.yaml && kustomize build"]
-  helm.valuesFileSchemes: "http, https, secrets+age-import-kubernetes"
\ No newline at end of file
diff --git a/resources/argocd-cm/env/k3s-cluster/config.json b/resources/secrets/env/k3s-cluster/config.json
similarity index 57%
rename from resources/argocd-cm/env/k3s-cluster/config.json
rename to resources/secrets/env/k3s-cluster/config.json
index 4086528..1bcd790 100644
--- a/resources/argocd-cm/env/k3s-cluster/config.json
+++ b/resources/secrets/env/k3s-cluster/config.json
@@ -1,9 +1,9 @@
 {
-  "appName": "argocd-cm",
-  "userGivenName": "argocd-cm",
-  "destNamespace": "argocd-cm",
+  "appName": "app-secrets",
+  "userGivenName": "app-secrets",
+  "destNamespace": "argocd",
   "destServer": "https://kubernetes.default.svc",
-  "srcPath": "resources/argocd-cm/env/k3s-cluster",
+  "srcPath": "resources/secrets/env/k3s-cluster",
   "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
   "srcTargetRevision": "",
   "labels": null,
diff --git a/resources/argocd-cm/base/kustomization.yaml b/resources/secrets/env/k3s-cluster/kustomization.yaml
similarity index 78%
rename from resources/argocd-cm/base/kustomization.yaml
rename to resources/secrets/env/k3s-cluster/kustomization.yaml
index f7eba3b..a227ac4 100644
--- a/resources/argocd-cm/base/kustomization.yaml
+++ b/resources/secrets/env/k3s-cluster/kustomization.yaml
@@ -1,4 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./configmap.yaml
\ No newline at end of file
+  - ../../base
\ No newline at end of file
diff --git a/scripts/2.install-argocd.sh b/scripts/2.install-argocd.sh
index ae34603..2f50267 100644
--- a/scripts/2.install-argocd.sh
+++ b/scripts/2.install-argocd.sh
@@ -6,6 +6,7 @@ kubectl create namespace argocd || echo "Namespace argocd already exists"
 helm repo add argo https://argoproj.github.io/argo-helm || echo "Argo repo already exists"
 helm repo update || echo "Failed to update helm repos"
 helm upgrade --install argocd -n argocd -f argocd-values.yaml argo/argo-cd --version 7.3.6
+helm plugin install https://github.com/jkroepke/helm-secrets
 
 #Check repo server secret accessibility
 echo "Checking repo server secret accessibility:"
diff --git a/scripts/argocd-values.yaml b/scripts/argocd-values.yaml
index 9864875..702b03c 100644
--- a/scripts/argocd-values.yaml
+++ b/scripts/argocd-values.yaml
@@ -6,6 +6,18 @@ global:
   domain: argocd.cluster.edward.sydney
 
 configs:
+  cm: >-
+    kustomize.buildOptions: "--enable-helm"
+    configManagementPlugins: |
+        - name: kustomized-helm
+          init:
+            command: ["/bin/sh", "-c"]
+            args: ["helm dependency build"]
+          generate:
+            command: [sh, -c]
+            args: ["helm template --release-name release-name . > all.yaml && kustomize build"]
+    helm.valuesFileSchemes: "secrets"
+
   params:
     server.insecure: true