diff --git a/templates/secret_config.yaml b/templates/secret_config.yaml
index 4b61dce..61bc051 100644
--- a/templates/secret_config.yaml
+++ b/templates/secret_config.yaml
@@ -14,10 +14,9 @@ metadata:
   name: {{ include "gitea.secret.config.name" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
-stringData:
-{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
-  assertions: |
-    {{- $assertions | nindent 4 }}
+data:
+{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
+  assertions: {{ $assertions | b64enc | quote }}
 {{- end }}
 
 {{- define "gitea.config.assertions" -}}
diff --git a/templates/secret_init.yaml b/templates/secret_init.yaml
index ee2903d..a323402 100644
--- a/templates/secret_init.yaml
+++ b/templates/secret_init.yaml
@@ -11,224 +11,229 @@ metadata:
   name: {{ include "gitea.secret.init.name" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
-stringData:
-{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
-  init_directory_structure.sh: |-
-    #!/usr/bin/env bash
-
-    set -euo pipefail
-
-    {{- if .Values.initPreScript }}
-    # BEGIN: initPreScript
-    {{- with .Values.initPreScript -}}
-    {{ . | nindent 4}}
-    {{- end -}}
-    # END: initPreScript
-    {{- end }}
-
-    {{- if not .Values.deployment.gitea.image.rootless }}
-    chown -v 1000:1000 /data
-    {{- end }}
-    mkdir -pv /data/git/.ssh
-    chmod -Rv 700 /data/git/.ssh
-    [ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
-
-    # prepare temp directory structure
-    mkdir -pv "${GITEA_TEMP}"
-    {{- if not .Values.deployment.gitea.image.rootless }}
-    chown -v 1000:1000 "${GITEA_TEMP}"
-    {{- end }}
-    chmod -v ug+rwx "${GITEA_TEMP}"
-
-    {{ if .Values.secrets.gpg.enabled -}}
-    if [ ! -d "${GNUPGHOME}" ]; then
-      mkdir -pv "${GNUPGHOME}"
-      chmod -v 700 "${GNUPGHOME}"
-      chown -v 1000:1000 "${GNUPGHOME}"
+data:
+{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsSecrets | indent 2 }}
+  configure_gitea.sh: {{ include "gitea.init.configureGitea" . | trimAll "\n" | b64enc | quote }}
+  init_directory_structure.sh: {{ include "gitea.init.initDirectoryStructure" . | trimAll "\n" | b64enc | quote }}
+{{- end }}
+
+{{- define "gitea.init.initDirectoryStructure" -}}
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+{{- if .Values.initPreScript }}
+# BEGIN: initPreScript
+{{- with .Values.initPreScript -}}
+{{ . | nindent 0 }}
+{{- end -}}
+# END: initPreScript
+{{- end }}
+
+{{- if not .Values.deployment.gitea.image.rootless }}
+chown -v 1000:1000 /data
+{{- end }}
+mkdir -pv /data/git/.ssh
+chmod -Rv 700 /data/git/.ssh
+[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
+
+# prepare temp directory structure
+mkdir -pv "${GITEA_TEMP}"
+{{- if not .Values.deployment.gitea.image.rootless }}
+chown -v 1000:1000 "${GITEA_TEMP}"
+{{- end }}
+chmod -v ug+rwx "${GITEA_TEMP}"
+
+{{ if .Values.secrets.gpg.enabled -}}
+if [ ! -d "${GNUPGHOME}" ]; then
+  mkdir -pv "${GNUPGHOME}"
+  chmod -v 700 "${GNUPGHOME}"
+  chown -v 1000:1000 "${GNUPGHOME}"
+fi
+{{- end }}
+{{- end }}
+
+{{- define "gitea.init.configureGitea" -}}
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo '==== BEGIN GITEA CONFIGURATION ===='
+
+{ # try
+  gitea migrate
+} || { # catch
+  echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
+  exit 1
+}
+
+{{- if include "valkey.servicename" . }}
+function test_valkey_connection() {
+  local RETRY=0
+  local MAX=30
+
+  echo 'Wait for valkey to become avialable...'
+  until [ "${RETRY}" -ge "${MAX}" ]; do
+    RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
+    RETRY=$[${RETRY}+1]
+    echo "...not ready yet (${RETRY}/${MAX})"
+  done
+
+  if [ "${RETRY}" -ge "${MAX}" ]; then
+    echo "Valkey not reachable after '${MAX}' attempts!"
+    exit 1
+  fi
+}
+
+test_valkey_connection
+{{- end }}
+
+
+{{- if .Values.secrets.admin.enabled }}
+function configure_admin_user() {
+  local full_admin_list=$(gitea admin user list --admin)
+  local actual_user_table=''
+
+  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+  local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
+  if [[ "${full_admin_list}" =~ $regex ]]; then
+    actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+  else
+    # This code block should never be reached, as long as the output table header remains the same.
+    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+    echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
+    echo "       Please review the output of 'gitea admin user list --admin' shown below."
+    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+    echo "DEBUG: Output of 'gitea admin user list --admin'"
+    echo "--"
+    echo "${full_admin_list}"
+    echo "--"
+    exit 1
+  fi
+
+  local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
+  if [[ -z "${ACCOUNT_ID}" ]]; then
+    local -a create_args
+    create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
+    if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
+      create_args+=(--must-change-password=true)
+    else
+      create_args+=(--must-change-password=false)
     fi
-    {{- end }}
-
-  configure_gitea.sh: |-
-    #!/usr/bin/env bash
-
-    set -euo pipefail
-
-    echo '==== BEGIN GITEA CONFIGURATION ===='
-
-    { # try
-      gitea migrate
-    } || { # catch
-      echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
-      exit 1
-    }
-
-    {{- if include "valkey.servicename" . }}
-    function test_valkey_connection() {
-      local RETRY=0
-      local MAX=30
-
-      echo 'Wait for valkey to become avialable...'
-      until [ "${RETRY}" -ge "${MAX}" ]; do
-        RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
-        RETRY=$[${RETRY}+1]
-        echo "...not ready yet (${RETRY}/${MAX})"
-      done
-
-      if [ "${RETRY}" -ge "${MAX}" ]; then
-        echo "Valkey not reachable after '${MAX}' attempts!"
-        exit 1
+    echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
+    gitea admin user create "${create_args[@]}"
+    echo '...created.'
+  else
+    if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
+      echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
+      # See https://gitea.com/gitea/helm-gitea/issues/673
+      # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
+      #   which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
+      #   should add it to prevent requiring frequent admin password resets.
+      local -a change_args
+      change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
+      if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
+        change_args+=(--must-change-password=false)
       fi
-    }
-
-    test_valkey_connection
-    {{- end }}
-
-
-    {{- if .Values.secrets.admin.enabled }}
-    function configure_admin_user() {
-      local full_admin_list=$(gitea admin user list --admin)
-      local actual_user_table=''
-
-      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-      local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
-      if [[ "${full_admin_list}" =~ $regex ]]; then
-        actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-      else
-        # This code block should never be reached, as long as the output table header remains the same.
-        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-        echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
-        echo "       Please review the output of 'gitea admin user list --admin' shown below."
-        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-        echo "DEBUG: Output of 'gitea admin user list --admin'"
-        echo "--"
-        echo "${full_admin_list}"
-        echo "--"
-        exit 1
-      fi
-
-      local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
-      if [[ -z "${ACCOUNT_ID}" ]]; then
-        local -a create_args
-        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
-        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
-          create_args+=(--must-change-password=true)
-        else
-          create_args+=(--must-change-password=false)
-        fi
-        echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
-        gitea admin user create "${create_args[@]}"
-        echo '...created.'
-      else
-        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
-          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
-          # See https://gitea.com/gitea/helm-gitea/issues/673
-          # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
-          #   which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
-          #   should add it to prevent requiring frequent admin password resets.
-          local -a change_args
-          change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
-          if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
-            change_args+=(--must-change-password=false)
-          fi
-          gitea admin user change-password "${change_args[@]}"
-          echo '...password sync done.'
-        else
-          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
-        fi
-      fi
-    }
-
-    configure_admin_user
-    {{- end }}
-
-    function configure_ldap() {
-      {{- if .Values.gitea.ldap }}
-      {{- range $idx, $value := .Values.gitea.ldap }}
-      local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
-      local full_auth_list=$(gitea admin auth list --vertical-bars)
-      local actual_auth_table=''
-
-      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-      local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
-      if [[ "${full_auth_list}" =~ $regex ]]; then
-        actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-      else
-        # This code block should never be reached, as long as the output table header remains the same.
-        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-        echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
-        echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
-        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-        echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
-        echo "--"
-        echo "${full_auth_list}"
-        echo "--"
-        exit 1
-      fi
-
-      local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " "  "{print \$1}")
-
-      if [[ -z "${GITEA_AUTH_ID}" ]]; then
-        echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
-        gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
-        echo '...installed.'
-      else
-        echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
-        gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
-        echo '...sync settings done.'
-      fi
-      {{- end }}
-      {{- else }}
-        echo 'no ldap configuration... skipping.'
-      {{- end }}
-    }
-
-    configure_ldap
-
-    function configure_oauth() {
-      {{- if .Values.gitea.oauth }}
-      {{- range $idx, $value := .Values.gitea.oauth }}
-      local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
-      local full_auth_list=$(gitea admin auth list --vertical-bars)
-      local actual_auth_table=''
-
-      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-      local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
-      if [[ "${full_auth_list}" =~ $regex ]]; then
-        actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-      else
-        # This code block should never be reached, as long as the output table header remains the same.
-        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-        echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
-        echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
-        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-        echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
-        echo "--"
-        echo "${full_auth_list}"
-        echo "--"
-        exit 1
-      fi
-
-      local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " "  "{print \$1}")
-
-      if [[ -z "${AUTH_ID}" ]]; then
-        echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
-        gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
-        echo '...installed.'
-      else
-        echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
-        gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
-        echo '...sync settings done.'
-      fi
-      {{- end }}
-      {{- else }}
-        echo 'no oauth configuration... skipping.'
-      {{- end }}
-    }
-
-    configure_oauth
-
-    echo '==== END GITEA CONFIGURATION ===='
+      gitea admin user change-password "${change_args[@]}"
+      echo '...password sync done.'
+    else
+      echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
+    fi
+  fi
+}
+
+configure_admin_user
+{{- end }}
+
+function configure_ldap() {
+  {{- if .Values.gitea.ldap }}
+  {{- range $idx, $value := .Values.gitea.ldap }}
+  local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
+  local full_auth_list=$(gitea admin auth list --vertical-bars)
+  local actual_auth_table=''
+
+  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+  local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
+  if [[ "${full_auth_list}" =~ $regex ]]; then
+    actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+  else
+    # This code block should never be reached, as long as the output table header remains the same.
+    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+    echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
+    echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
+    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+    echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
+    echo "--"
+    echo "${full_auth_list}"
+    echo "--"
+    exit 1
+  fi
+
+  local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " "  "{print \$1}")
+
+  if [[ -z "${GITEA_AUTH_ID}" ]]; then
+    echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
+    gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
+    echo '...installed.'
+  else
+    echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
+    gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
+    echo '...sync settings done.'
+  fi
+  {{- end }}
+  {{- else }}
+    echo 'no ldap configuration... skipping.'
+  {{- end }}
+}
+
+configure_ldap
+
+function configure_oauth() {
+  {{- if .Values.gitea.oauth }}
+  {{- range $idx, $value := .Values.gitea.oauth }}
+  local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
+  local full_auth_list=$(gitea admin auth list --vertical-bars)
+  local actual_auth_table=''
+
+  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+  local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
+  if [[ "${full_auth_list}" =~ $regex ]]; then
+    actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+  else
+    # This code block should never be reached, as long as the output table header remains the same.
+    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+    echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
+    echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
+    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+    echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
+    echo "--"
+    echo "${full_auth_list}"
+    echo "--"
+    exit 1
+  fi
+
+  local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " "  "{print \$1}")
+
+  if [[ -z "${AUTH_ID}" ]]; then
+    echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
+    gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
+    echo '...installed.'
+  else
+    echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
+    gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
+    echo '...sync settings done.'
+  fi
+  {{- end }}
+  {{- else }}
+    echo 'no oauth configuration... skipping.'
+  {{- end }}
+}
+
+configure_oauth
+
+echo '==== END GITEA CONFIGURATION ===='
 {{- end }}
diff --git a/unittests/helm/config/config-environment-script.yaml b/unittests/helm/config/config-environment-script.yaml
index 28a1e5d..03bf2f8 100644
--- a/unittests/helm/config/config-environment-script.yaml
+++ b/unittests/helm/config/config-environment-script.yaml
@@ -11,5 +11,15 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData["config_environment.sh"]
+          path: data["config_environment.sh"]
+          decodeBase64: true
           pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
+  - it: renders data, not stringData, so removed keys are pruned on upgrade
+    template: templates/secret_config.yaml
+    asserts:
+      - documentIndex: 0
+        notExists:
+          path: stringData
+      - documentIndex: 0
+        exists:
+          path: data["config_environment.sh"]
diff --git a/unittests/helm/dependency-checks/customization-integrity-valkey.yaml b/unittests/helm/dependency-checks/customization-integrity-valkey.yaml
index 4b32674..696fad4 100644
--- a/unittests/helm/dependency-checks/customization-integrity-valkey.yaml
+++ b/unittests/helm/dependency-checks/customization-integrity-valkey.yaml
@@ -39,7 +39,8 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData["configure_gitea.sh"]
+          path: data["configure_gitea.sh"]
+          decodeBase64: true
           pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
   - it: "[gitea] waits for valkey to be up and running with custom cluster domain"
     set:
@@ -48,5 +49,6 @@ tests:
     asserts:
       - documentIndex: 0
         matchRegex:
-          path: stringData["configure_gitea.sh"]
+          path: data["configure_gitea.sh"]
+          decodeBase64: true
           pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379
diff --git a/unittests/helm/init/init_directory_structure.sh-rootless.yaml b/unittests/helm/init/init_directory_structure.sh-rootless.yaml
index 48eaf7e..915bfd8 100644
--- a/unittests/helm/init/init_directory_structure.sh-rootless.yaml
+++ b/unittests/helm/init/init_directory_structure.sh-rootless.yaml
@@ -14,7 +14,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["configure_gpg_environment.sh"]
+          path: data["configure_gpg_environment.sh"]
+          decodeBase64: true
           value: |
             #!/usr/bin/env bash
             set -eu
@@ -23,7 +24,8 @@ tests:
   - it: skips gpg script block for disabled signing
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -44,7 +46,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -68,7 +71,8 @@ tests:
       deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.20.5
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -80,3 +84,9 @@ tests:
             # prepare temp directory structure
             mkdir -pv "${GITEA_TEMP}"
             chmod -v ug+rwx "${GITEA_TEMP}"
+  - it: renders data, not stringData, so removed keys are pruned on upgrade
+    asserts:
+      - notExists:
+          path: stringData
+      - exists:
+          path: data["init_directory_structure.sh"]
diff --git a/unittests/helm/init/init_directory_structure.sh.yaml b/unittests/helm/init/init_directory_structure.sh.yaml
index cc67bf6..c819cd9 100644
--- a/unittests/helm/init/init_directory_structure.sh.yaml
+++ b/unittests/helm/init/init_directory_structure.sh.yaml
@@ -15,7 +15,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["configure_gpg_environment.sh"]
+          path: data["configure_gpg_environment.sh"]
+          decodeBase64: true
           value: |
             #!/usr/bin/env bash
             set -eu
@@ -26,7 +27,8 @@ tests:
       deployment.gitea.image.rootless: false
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -50,7 +52,8 @@ tests:
         -----END PGP PRIVATE KEY BLOCK-----
     asserts:
       - equal:
-          path: stringData["init_directory_structure.sh"]
+          path: data["init_directory_structure.sh"]
+          decodeBase64: true
           value: |-
             #!/usr/bin/env bash
 
@@ -70,3 +73,11 @@ tests:
               chmod -v 700 "${GNUPGHOME}"
               chown -v 1000:1000 "${GNUPGHOME}"
             fi
+  - it: renders data, not stringData, so removed keys are pruned on upgrade
+    set:
+      deployment.gitea.image.rootless: false
+    asserts:
+      - notExists:
+          path: stringData
+      - exists:
+          path: data["init_directory_structure.sh"]