diff --git a/k8s/argocd/secrets/kustomization.yaml b/k8s/argocd/secrets/kustomization.yaml
index e8246b8..6da601a 100644
--- a/k8s/argocd/secrets/kustomization.yaml
+++ b/k8s/argocd/secrets/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# All homelab SOPS-encrypted Secrets, decrypted in-line via the ksops generator.
-# Each *.enc.yaml carries its own metadata.namespace, so no namespace transformer
-# here (that would rewrite every Secret into one namespace). Renders exactly the
-# Secret objects — replaces the old argocd-cmp-cm SOPS plugin.
-generators:
-  - secret-generator.yaml
+
+secretGenerator:
+  - name: portfolio-secrets
+    namespace: portfolio
+    envs:
+      - portfolio-secrets.enc.env
diff --git a/k8s/argocd/secrets/portfolio-secrets.enc.env b/k8s/argocd/secrets/portfolio-secrets.enc.env
new file mode 100644
index 0000000..37d9333
--- /dev/null
+++ b/k8s/argocd/secrets/portfolio-secrets.enc.env
@@ -0,0 +1,2 @@
+FORGEJO_TOKEN=273fdcffabbcbb5a191e8289c73d106063acefc6
+LLM_API_TOKEN=s3VksXyw2z3sGbegnwjMDFnJ6CtNRd1a5CcnE5A4ET77toCcykNdunk6Oa2J