diff --git a/templates/secret_inlineConfig.yaml b/templates/secret_inlineConfig.yaml
index 96d37d8..91d12bb 100644
--- a/templates/secret_inlineConfig.yaml
+++ b/templates/secret_inlineConfig.yaml
@@ -14,6 +14,8 @@ metadata:
   name: {{ include "gitea.secret.inlineConfig.name" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
-stringData:
-  {{- $inlineConfiguration | nindent 2 }}
+data:
+  {{- range $key, $value := fromYaml $inlineConfiguration }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+  {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/unittests/helm/config/actions-config.yaml b/unittests/helm/config/actions-config.yaml
index 7851bcf..c1aede2 100644
--- a/unittests/helm/config/actions-config.yaml
+++ b/unittests/helm/config/actions-config.yaml
@@ -10,7 +10,7 @@ tests:
     asserts:
       - documentIndex: 0
         notExists:
-          path: stringData.actions
+          path: data.actions
 
   - it: "actions can be disabled via inline config"
     template: templates/secret_inlineConfig.yaml
@@ -19,6 +19,7 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.actions
+          path: data.actions
+          decodeBase64: true
           value: |-
             ENABLED=false
diff --git a/unittests/helm/config/cache-config.yaml b/unittests/helm/config/cache-config.yaml
index 986e728..0fdc3d7 100644
--- a/unittests/helm/config/cache-config.yaml
+++ b/unittests/helm/config/cache-config.yaml
@@ -11,7 +11,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.cache
+          path: data.cache
+          decodeBase64: true
           value: |-
             ADAPTER=redis
             HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
@@ -24,7 +25,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.cache
+          path: data.cache
+          decodeBase64: true
           value: |-
             ADAPTER=memory
             HOST=
@@ -39,7 +41,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.cache
+          path: data.cache
+          decodeBase64: true
           value: |-
             ADAPTER=custom-adapter
             HOST=custom-host
diff --git a/unittests/helm/config/metrics-section_metrics-token.yaml b/unittests/helm/config/metrics-section_metrics-token.yaml
index 2b440ff..7062488 100644
--- a/unittests/helm/config/metrics-section_metrics-token.yaml
+++ b/unittests/helm/config/metrics-section_metrics-token.yaml
@@ -13,7 +13,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.metrics
+          path: data.metrics
+          decodeBase64: true
           value: |-
             ENABLED=true
             TOKEN=somepassword
@@ -27,7 +28,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.metrics
+          path: data.metrics
+          decodeBase64: true
           value: |-
             ENABLED=true
   - it: metrics token is nil
@@ -40,7 +42,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.metrics
+          path: data.metrics
+          decodeBase64: true
           value: |-
             ENABLED=true
   - it: does not configures a token if metrics are disabled
@@ -53,6 +56,7 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.metrics
+          path: data.metrics
+          decodeBase64: true
           value: |-
             ENABLED=false
diff --git a/unittests/helm/config/queue-config.yaml b/unittests/helm/config/queue-config.yaml
index e862411..40f3e95 100644
--- a/unittests/helm/config/queue-config.yaml
+++ b/unittests/helm/config/queue-config.yaml
@@ -11,7 +11,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.queue
+          path: data.queue
+          decodeBase64: true
           value: |-
             CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
             TYPE=redis
@@ -24,7 +25,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.queue
+          path: data.queue
+          decodeBase64: true
           value: |-
             CONN_STR=
             TYPE=level
@@ -39,7 +41,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.queue
+          path: data.queue
+          decodeBase64: true
           value: |-
             CONN_STR=custom-connection-string
             TYPE=custom-type
diff --git a/unittests/helm/config/server-section_domain.yaml b/unittests/helm/config/server-section_domain.yaml
index a079959..ead24f1 100644
--- a/unittests/helm/config/server-section_domain.yaml
+++ b/unittests/helm/config/server-section_domain.yaml
@@ -8,15 +8,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=git.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=git.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://git.example.com
 
   ################################################
@@ -29,15 +32,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
 
   ################################################
@@ -55,15 +61,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=provided.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=provided.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://provided.example.com
 
   ################################################
@@ -77,15 +86,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=route.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=route.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://route.example.com
 
   ################################################
@@ -101,7 +113,8 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=https://route.example.com
 
   ################################################
@@ -123,15 +136,18 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nDOMAIN=gw.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nSSH_DOMAIN=gw.example.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=http://gw.example.com
 
   ################################################
@@ -154,5 +170,6 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: \nROOT_URL=https://gw.example.com
diff --git a/unittests/helm/config/session-config.yaml b/unittests/helm/config/session-config.yaml
index 4f5f688..e54f27d 100644
--- a/unittests/helm/config/session-config.yaml
+++ b/unittests/helm/config/session-config.yaml
@@ -11,7 +11,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.session
+          path: data.session
+          decodeBase64: true
           value: |-
             PROVIDER=redis
             PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
@@ -24,7 +25,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.session
+          path: data.session
+          decodeBase64: true
           value: |-
             PROVIDER=memory
             PROVIDER_CONFIG=
@@ -39,7 +41,8 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: stringData.session
+          path: data.session
+          decodeBase64: true
           value: |-
             PROVIDER=custom-provider
             PROVIDER_CONFIG=custom-provider-config
diff --git a/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml b/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml
index c357740..d9c77c2 100644
--- a/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml
+++ b/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml
@@ -110,7 +110,8 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
   - it: "[gitea] connects to pgpool service with custom cluster domain"
     set:
@@ -119,20 +120,24 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
   - it: "[gitea] connects to configured database"
     template: templates/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: NAME=gitea-database
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: USER=gitea-username
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: PASSWD=gitea-password
diff --git a/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml b/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml
index dfa2094..aae0a63 100644
--- a/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml
+++ b/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml
@@ -69,7 +69,8 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
   - it: "[gitea] connects to postgresql service with custom cluster domain"
     set:
@@ -78,20 +79,24 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234
   - it: "[gitea] connects to configured database"
     template: templates/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: NAME=gitea-database
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: USER=gitea-username
       - documentIndex: 0
         matchRegex:
-          path: stringData.database
+          path: data.database
+          decodeBase64: true
           pattern: PASSWD=gitea-password
diff --git a/unittests/helm/deployment/inline-config.yaml b/unittests/helm/deployment/inline-config.yaml
index dc6f97e..c07a97a 100644
--- a/unittests/helm/deployment/inline-config.yaml
+++ b/unittests/helm/deployment/inline-config.yaml
@@ -5,7 +5,7 @@ release:
 templates:
   - templates/secret_inlineConfig.yaml
 tests:
-  - it: inline config stringData.server using TPL
+  - it: inline config data.server using TPL
     set:
       global.giteaHostName: "gitea.example.com"
       ingress.enabled: true
@@ -21,13 +21,24 @@ tests:
           pattern: .*-inline-config$
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: DOMAIN=gitea\.example\.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: ROOT_URL=https://gitea\.example\.com
       - documentIndex: 0
         matchRegex:
-          path: stringData.server
+          path: data.server
+          decodeBase64: true
           pattern: SSH_DOMAIN=gitea\.example\.com
+  - it: renders data, not stringData, so removed sections are pruned on upgrade
+    asserts:
+      - documentIndex: 0
+        notExists:
+          path: stringData
+      - documentIndex: 0
+        exists:
+          path: data.server