diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/certauthority.yml b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/certauthority.yml
index d1bbdd3..00e5dc0 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/certauthority.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/certauthority.yml
@@ -36,8 +36,7 @@
       name: "{{ item.name }}"
       namespace: "{{ item.namespace }}"
       labels: "{{ item.labels | default({}) | indent(width=4, indent=True) }}"
-      key: "{{ item.key }}"
-      value: "{{ item.value }}"
+      data: "{{ item.data }}"
   loop:
     - name: argocd-tls-certs-cm
       namespace: argo-cd
@@ -45,13 +44,15 @@
       labels: |
         app.kubernetes.io/name: argocd-cm
         app.kubernetes.io/part-of: argocd
-      key: git.{{ vapp['metacluster.fqdn'] }}
-      value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] }}"
+      data:
+      - key: git.{{ vapp['metacluster.fqdn'] }}
+        value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] }}"
     - name: step-certificates-certs
       namespace: kube-system
       kind: secret
-      key: root_ca.crt
-      value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] | b64encode }}"
+      data:
+      - key: root_ca.crt
+        value: "{{ stepca_cm_certs.resources[0].data['root_ca.crt'] | b64encode }}"
   loop_control:
     label: "{{ item.kind + '/' + item.name + ' (' + item.namespace + ')' }}"
 
diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml
index 7c96fbf..2b6bf8c 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml
@@ -5,6 +5,7 @@
 - import_tasks: storage.yml
 - import_tasks: certauthority.yml
 - import_tasks: registry.yml
+- import_tasks: secrets.yml
 - import_tasks: git.yml
 - import_tasks: gitops.yml
 
diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml
new file mode 100644
index 0000000..c26edb8
--- /dev/null
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/secrets.yml
@@ -0,0 +1,25 @@
+- name: Install sealed-secrets chart
+  kubernetes.core.helm:
+    name: sealed-secrets-controller
+    chart_ref: /opt/metacluster/helm-charts/sealed-secrets
+    release_namespace: kube-system
+    wait: yes
+    kubeconfig: "{{ kubeconfig.path }}"
+    values: "{{ components.sealedsecrets.chart_values }}"
+
+- name: Store hypervisor details in secret
+  kubernetes.core.k8s:
+    state: present
+    template: secret.j2
+    kubeconfig: "{{ kubeconfig.path }}"
+  vars:
+    _template:
+      name: hypervisor-credentials
+      namespace: kube-system
+      data:
+        - key: HV_FQDN
+          value: "{{ vapp['hv.fqdn'] | b64encode }}"
+        - key: HV_USERNAME
+          value: "{{ vapp['hv.username'] | b64encode }}"
+        - key: HV_PASSWORD
+          value: "{{ vapp['hv.password'] | b64encode }}"
diff --git a/ansible/roles/firstboot/files/ansible_payload/templates/configmap.j2 b/ansible/roles/firstboot/files/ansible_payload/templates/configmap.j2
index fe4a625..3926bdd 100644
--- a/ansible/roles/firstboot/files/ansible_payload/templates/configmap.j2
+++ b/ansible/roles/firstboot/files/ansible_payload/templates/configmap.j2
@@ -6,4 +6,6 @@ metadata:
   labels:
 {{ _template.labels }}
 data:
-  "{{ _template.key }}": {{ _template.value }}
+{% for kv_pair in _template.data %}
+  "{{ kv_pair.key }}": {{ kv_pair.value }}
+{% endfor %}
diff --git a/ansible/roles/firstboot/files/ansible_payload/templates/secret.j2 b/ansible/roles/firstboot/files/ansible_payload/templates/secret.j2
index 01f4726..9537088 100644
--- a/ansible/roles/firstboot/files/ansible_payload/templates/secret.j2
+++ b/ansible/roles/firstboot/files/ansible_payload/templates/secret.j2
@@ -4,4 +4,6 @@ metadata:
   name: {{ _template.name }}
   namespace: {{ _template.namespace }}
 data:
-  "{{ _template.key }}": {{ _template.value }}
+{% for kv_pair in _template.data %}
+  "{{ kv_pair.key }}": {{ kv_pair.value }}
+{% endfor %}
diff --git a/ansible/vars/metacluster.yml b/ansible/vars/metacluster.yml
index ac9dbbb..b04d08f 100644
--- a/ansible/vars/metacluster.yml
+++ b/ansible/vars/metacluster.yml
@@ -150,26 +150,6 @@ components:
         configs:
           secret:
             argocdServerAdminPassword: "{{ vapp['guestinfo.rootpw'] | password_hash('bcrypt') }}"
-        # controller:
-        #   volumeMounts:
-        #     - name: custom-ca-certificates
-        #       mountPath: /etc/ssl/certs/custom-ca-certificates.crt
-        #       subPath: custom-ca-certificates.crt
-        #   volumes:
-        #     - name: custom-ca-certificates
-        #       secret:
-        #         defaultMode: 420
-        #         secretName: step-certificates-certs
-        # repoServer:
-        #   volumeMounts:
-        #     - name: custom-ca-certificates
-        #       mountPath: /etc/ssl/certs/custom-ca-certificates.crt
-        #       subPath: custom-ca-certificates.crt
-        #   volumes:
-        #     - name: custom-ca-certificates
-        #       secret:
-        #         defaultMode: 420
-        #         secretName: step-certificates-certs
         server:
           extraArgs:
             - --insecure
@@ -177,15 +157,6 @@ components:
             enabled: true
             hosts:
               - gitops.{{ vapp['metacluster.fqdn'] }}
-        #   volumeMounts:
-        #     - name: custom-ca-certificates
-        #       mountPath: /etc/ssl/certs/custom-ca-certificates.crt
-        #       subPath: custom-ca-certificates.crt
-        #   volumes:
-        #     - name: custom-ca-certificates
-        #       secret:
-        #         defaultMode: 420
-        #         secretName: step-certificates-certs
 
   sealed-secrets:
     helm:
@@ -214,6 +185,9 @@ dependencies:
       url: https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz
       archive: compressed
       extra_opts: --strip-components=1
+    - filename: kubeseal
+      url: https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.18.2/kubeseal-0.18.2-linux-amd64.tar.gz
+      archive: compressed
     - filename: skopeo
       url: https://code.spamasaurus.com/api/packages/djpbessems/generic/skopeo/v1.9.1/skopeo
     - filename: step