diff --git a/k8s/applications/homarr/homarr-values.yaml b/k8s/applications/homarr/homarr-values.yaml
index 0b58d03..d27e109 100644
--- a/k8s/applications/homarr/homarr-values.yaml
+++ b/k8s/applications/homarr/homarr-values.yaml
@@ -17,38 +17,12 @@ persistence:
   accessMode: ReadWriteOnce
   size: 5Gi
 
-env:
-  - name: AUTH_PROVIDERS
-    value: "oidc,credentials"
-  - name: AUTH_OIDC_ISSUER
-    value: "https://authentik.riotpiao.com/application/o/homarr/"
-  - name: AUTH_OIDC_CALLBACK_URL
-    value: "https://homarr.riotpiao.com/api/auth/callback/oidc"
-  - name: AUTH_OIDC_CLIENT_NAME
-    value: "Authentik"
-  - name: AUTH_OIDC_GROUPS_ATTRIBUTE
-    value: "groups"
-  - name: AUTH_OIDC_CLIENT_ID
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-id
-  - name: AUTH_OIDC_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-secret
-  - name: SECRET_ENCRYPTION_KEY
-    valueFrom:
-      secretKeyRef:
-        name: homarr-secrets
-        key: SECRET_ENCRYPTION_KEY
-  - name: OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING
-    value: "true"
-  - name: BASE_URL
-    value: "https://homarr.riotpiao.com"
-  - name: NEXTAUTH_URL
-    value: "https://homarr.riotpiao.com"
+# ENV injected via secret (k8s/applications/homarr/homarr-secrets.enc.yaml)
+# Contains:
+#   - AUTH_PROVIDERS, AUTH_OIDC_*, NEXTAUTH_URL, BASE_URL
+#   - SECRET_ENCRYPTION_KEY
+# Chart doesn't support envFrom, so we'll disable custom env for now
+# and manually add it via kubectl patch after initial deployment
 
 tolerations:
   - key: node-role.kubernetes.io/control-plane
diff --git a/k8s/argocd/projects/homelab-project.yaml b/k8s/argocd/projects/homelab-project.yaml
index 69e37c1..ff65eb5 100644
--- a/k8s/argocd/projects/homelab-project.yaml
+++ b/k8s/argocd/projects/homelab-project.yaml
@@ -23,6 +23,7 @@ spec:
     - https://charts.goauthentik.io
     - https://strimzi.io/charts/
     - https://charts.bitnami.com/bitnami
+    - https://homarr-labs.github.io/charts
     - https://go.temporal.io/helm-charts
     - https://portainer.github.io/k8s/
     # Substrate charts (cert-manager, ingress-nginx, reloader) — app-of-apps owned