diff --git a/k8s/platform/logging/loki-values.yaml b/k8s/platform/logging/loki-values.yaml
index 43c6b15..94b5941 100644
--- a/k8s/platform/logging/loki-values.yaml
+++ b/k8s/platform/logging/loki-values.yaml
@@ -37,8 +37,10 @@ loki:
       region: us-east-1          # MinIO ignores region but Loki's S3 client requires it
       s3ForcePathStyle: true
       insecure: true
-      access_key_id: ""          # overridden by helmfile --set (MINIO_ROOT_USER)
-      secret_access_key: ""      # overridden by helmfile --set (MINIO_ROOT_PASSWORD)
+      # Interpolated at runtime from the loki-s3-creds Secret (SOPS-CMP emitted),
+      # injected as env vars via extraEnvFrom below. Requires -config.expand-env.
+      access_key_id: "${access_key_id}"
+      secret_access_key: "${secret_access_key}"
     bucketNames:
       chunks: loki-chunks
       ruler: loki-ruler
@@ -110,6 +112,14 @@ loki:
 singleBinary:
   replicas: 1
 
+  # Interpolate ${access_key_id}/${secret_access_key} in the S3 config from the
+  # loki-s3-creds Secret (SOPS-CMP emitted).
+  extraArgs:
+    - "-config.expand-env=true"
+  extraEnvFrom:
+    - secretRef:
+        name: loki-s3-creds
+
   resources:
     requests:
       cpu: 100m