diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index 9d0b91a..934efa4 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -507,10 +507,6 @@ https
   {{- end -}}
 {{- end -}}
 
-{{- define "gitea.gpg-key-secret-name" -}}
-{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
-{{- end -}}
-
 {{- define "gitea.serviceAccountName" -}}
 {{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
 {{- end -}}
@@ -553,6 +549,3 @@ https
   {{- toYaml $probe -}}
 {{- end -}}
 
-{{- define "gitea.metrics-secret-name" -}}
-{{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
-{{- end -}}
diff --git a/templates/gitea/_secrets.tpl b/templates/gitea/_secrets.tpl
new file mode 100644
index 0000000..aef22a9
--- /dev/null
+++ b/templates/gitea/_secrets.tpl
@@ -0,0 +1,23 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* names */}}
+
+{{- define "gitea.secret.config.name" -}}
+{{ include "gitea.fullname" . }}-config
+{{- end }}
+
+{{- define "gitea.secret.gpg.name" -}}
+{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
+{{- end }}
+
+{{- define "gitea.secret.init.name" -}}
+{{ include "gitea.fullname" . }}-init
+{{- end }}
+
+{{- define "gitea.secret.inlineConfig.name" -}}
+{{ include "gitea.fullname" . }}-inline-config
+{{- end }}
+
+{{- define "gitea.secret.metrics.name" -}}
+{{ include "gitea.fullname" . }}-metrics
+{{- end }}
diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml
index 1d8106c..219736a 100644
--- a/templates/gitea/deployment.yaml
+++ b/templates/gitea/deployment.yaml
@@ -28,6 +28,7 @@ spec:
     metadata:
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }}
+        checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }}
         {{- range $idx, $value := .Values.gitea.ldap }}
         checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
         {{- end }}
@@ -419,18 +420,18 @@ spec:
       volumes:
         - name: init
           secret:
-            secretName: {{ include "gitea.fullname" . }}-init
+            secretName: {{ include "gitea.secret.init.name" . }}
             defaultMode: 110
         - name: config
           secret:
-            secretName: {{ include "gitea.fullname" . }}
+            secretName: {{ include "gitea.secret.config.name" . }}
             defaultMode: 110
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
         - name: inline-config-sources
           secret:
-            secretName: {{ include "gitea.fullname" . }}-inline-config
+            secretName: {{ include "gitea.secret.inlineConfig.name" . }}
         {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
         - name: additional-config-sources-{{ $idx }}
           {{- toYaml $value | nindent 10 }}
@@ -440,7 +441,7 @@ spec:
         {{- if .Values.signing.enabled }}
         - name: gpg-private-key
           secret:
-            secretName: {{ include "gitea.gpg-key-secret-name" . }}
+            secretName: {{ include "gitea.secret.gpg.name" . }}
             items:
               - key: privateKey
                 path: private.asc
diff --git a/templates/gitea/secret_config.yaml b/templates/gitea/secret_config.yaml
index 50dd4ea..70bc154 100644
--- a/templates/gitea/secret_config.yaml
+++ b/templates/gitea/secret_config.yaml
@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.config.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 stringData:
 {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
diff --git a/templates/gitea/secret_gpg.yaml b/templates/gitea/secret_gpg.yaml
index 46633c8..4ac8e6e 100644
--- a/templates/gitea/secret_gpg.yaml
+++ b/templates/gitea/secret_gpg.yaml
@@ -6,10 +6,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "gitea.gpg-key-secret-name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.gpg.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 data:
   privateKey: {{ .Values.signing.privateKey | b64enc }}
diff --git a/templates/gitea/secret_init.yaml b/templates/gitea/secret_init.yaml
index 1bcd4e6..e3d8dc0 100644
--- a/templates/gitea/secret_init.yaml
+++ b/templates/gitea/secret_init.yaml
@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "gitea.fullname" . }}-init
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.init.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 stringData:
 {{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
@@ -61,7 +61,7 @@ stringData:
     function test_valkey_connection() {
       local RETRY=0
       local MAX=30
-      
+
       echo 'Wait for valkey to become avialable...'
       until [ "${RETRY}" -ge "${MAX}" ]; do
         RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
@@ -77,7 +77,7 @@ stringData:
 
     test_valkey_connection
     {{- end }}
-    
+
 
     {{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
     function configure_admin_user() {
diff --git a/templates/gitea/secret_inlineConfig.yaml b/templates/gitea/secret_inlineConfig.yaml
index fad7b7c..c8778f0 100644
--- a/templates/gitea/secret_inlineConfig.yaml
+++ b/templates/gitea/secret_inlineConfig.yaml
@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "gitea.fullname" . }}-inline-config
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.inlineConfig.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 stringData:
   {{- include "gitea.inline_configuration" . | nindent 2 }}
\ No newline at end of file
diff --git a/templates/gitea/secret_metrics.yaml b/templates/gitea/secret_metrics.yaml
index fe26596..5651353 100644
--- a/templates/gitea/secret_metrics.yaml
+++ b/templates/gitea/secret_metrics.yaml
@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "gitea.metrics-secret-name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.metrics.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 data:
   token: {{ .Values.gitea.metrics.token  | b64enc }}
diff --git a/templates/gitea/serviceMonitor.yaml b/templates/gitea/serviceMonitor.yaml
index 502a1a8..e5017e6 100644
--- a/templates/gitea/serviceMonitor.yaml
+++ b/templates/gitea/serviceMonitor.yaml
@@ -36,7 +36,7 @@ spec:
     authorization:
       type: Bearer
       credentials:
-        name: {{ include "gitea.metrics-secret-name" . }}
+        name: {{ include "gitea.secret.metrics.name" . }}
         key: token
         optional: false
     {{- end }}
diff --git a/unittests/helm/deployment/HA.yaml b/unittests/helm/deployment/HA.yaml
index 3c8be6a..8344b0b 100644
--- a/unittests/helm/deployment/HA.yaml
+++ b/unittests/helm/deployment/HA.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: fails with multiple replicas and "GIT_GC_REPOS" enabled
     template: templates/gitea/secret_config.yaml
diff --git a/unittests/helm/deployment/basic.yaml b/unittests/helm/deployment/basic.yaml
index 3bf9197..757366f 100644
--- a/unittests/helm/deployment/basic.yaml
+++ b/unittests/helm/deployment/basic.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: renders a deployment
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/deployment-additional-config.yaml b/unittests/helm/deployment/deployment-additional-config.yaml
index 36d4adb..894c056 100644
--- a/unittests/helm/deployment/deployment-additional-config.yaml
+++ b/unittests/helm/deployment/deployment-additional-config.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: Renders a deployment
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/extraEnvSourceFile.yaml b/unittests/helm/deployment/extraEnvSourceFile.yaml
index b7b17ee..15acdfd 100644
--- a/unittests/helm/deployment/extraEnvSourceFile.yaml
+++ b/unittests/helm/deployment/extraEnvSourceFile.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: uses direct execution when extraEnvSourceFile is not set
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/extraInitContainers.yaml b/unittests/helm/deployment/extraInitContainers.yaml
index ca31cf4..c23191d 100644
--- a/unittests/helm/deployment/extraInitContainers.yaml
+++ b/unittests/helm/deployment/extraInitContainers.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: Render the deployment (default)
     asserts:
diff --git a/unittests/helm/deployment/image-configuration.yaml b/unittests/helm/deployment/image-configuration.yaml
index 4987dc2..7bfa04f 100644
--- a/unittests/helm/deployment/image-configuration.yaml
+++ b/unittests/helm/deployment/image-configuration.yaml
@@ -8,6 +8,7 @@ chart:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: default values
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/openshift.yaml b/unittests/helm/deployment/openshift.yaml
index 555d580..1b0329a 100644
--- a/unittests/helm/deployment/openshift.yaml
+++ b/unittests/helm/deployment/openshift.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: renders openshift-compatible defaults for chart-managed containers
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/probes.yaml b/unittests/helm/deployment/probes.yaml
index 2b1b11e..86a5fe5 100644
--- a/unittests/helm/deployment/probes.yaml
+++ b/unittests/helm/deployment/probes.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: renders default liveness probe
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/sidecar-container.yaml b/unittests/helm/deployment/sidecar-container.yaml
index 4ab81b2..c58c5ca 100644
--- a/unittests/helm/deployment/sidecar-container.yaml
+++ b/unittests/helm/deployment/sidecar-container.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: supports adding a sidecar container
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/signing-disabled.yaml b/unittests/helm/deployment/signing-disabled.yaml
index 47af91f..6de1193 100644
--- a/unittests/helm/deployment/signing-disabled.yaml
+++ b/unittests/helm/deployment/signing-disabled.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: skips gpg init container
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/signing-enabled.yaml b/unittests/helm/deployment/signing-enabled.yaml
index 4adf0be..7de53f3 100644
--- a/unittests/helm/deployment/signing-enabled.yaml
+++ b/unittests/helm/deployment/signing-enabled.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: adds gpg init container
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/deployment/ssh-configuration.yaml b/unittests/helm/deployment/ssh-configuration.yaml
index 9d2e958..8895e83 100644
--- a/unittests/helm/deployment/ssh-configuration.yaml
+++ b/unittests/helm/deployment/ssh-configuration.yaml
@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: supports defining SSH log level for root based image
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/metric-secret/metrics-secret-servicemonitor-enabled.yaml b/unittests/helm/metric-secret/metrics-secret-servicemonitor-enabled.yaml
index 2320d86..3db0810 100644
--- a/unittests/helm/metric-secret/metrics-secret-servicemonitor-enabled.yaml
+++ b/unittests/helm/metric-secret/metrics-secret-servicemonitor-enabled.yaml
@@ -25,7 +25,7 @@ tests:
         containsDocument:
           kind: Secret
           apiVersion: v1
-          name: gitea-unittests-metrics-secret
+          name: gitea-unittests-metrics
       - isNotNullOrEmpty:
           path: metadata.labels
       - equal:
diff --git a/unittests/helm/serviceaccount/reference.yaml b/unittests/helm/serviceaccount/reference.yaml
index 66bd67d..4c8de3f 100644
--- a/unittests/helm/serviceaccount/reference.yaml
+++ b/unittests/helm/serviceaccount/reference.yaml
@@ -6,6 +6,7 @@ templates:
   - templates/gitea/serviceAccount.yaml
   - templates/gitea/deployment.yaml
   - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: does not modify the deployment by default
     template: templates/gitea/deployment.yaml
diff --git a/unittests/helm/servicemonitor/servicemonitor-enabled.yaml b/unittests/helm/servicemonitor/servicemonitor-enabled.yaml
index 1ae5759..9def6dd 100644
--- a/unittests/helm/servicemonitor/servicemonitor-enabled.yaml
+++ b/unittests/helm/servicemonitor/servicemonitor-enabled.yaml
@@ -65,6 +65,6 @@ tests:
               authorization:
                 type: Bearer
                 credentials:
-                  name: gitea-unittests-metrics-secret
+                  name: gitea-unittests-metrics
                   key: token
                   optional: false