diff --git a/argocd/kustomization.yaml b/argocd/kustomization.yaml
index e6f9f7e..323e3c2 100644
--- a/argocd/kustomization.yaml
+++ b/argocd/kustomization.yaml
@@ -5,6 +5,7 @@ namespace: argo-system
 
 resources:
   - resources/namespace.yaml
+  - resources/secret.harbor-credentials.yaml
   - resources/secret.git-age.yaml
   - resources/configmap.git.yaml
   - resources/dragonfly.yml
diff --git a/argocd/resources/secret.harbor-credentials.yaml b/argocd/resources/secret.harbor-credentials.yaml
new file mode 100644
index 0000000..6dd7168
Binary files /dev/null and b/argocd/resources/secret.harbor-credentials.yaml differ
diff --git a/ente/.gitattributes b/ente/.gitattributes
index 677a2c6..ec2b07d 100644
--- a/ente/.gitattributes
+++ b/ente/.gitattributes
@@ -1 +1,2 @@
 credentials.yaml filter=age diff=age merge=age -text
+**/secret.*.yaml filter=age diff=age merge=age -text
diff --git a/ente/kustomization.yaml b/ente/kustomization.yaml
index 5ad18ac..2171e6f 100644
--- a/ente/kustomization.yaml
+++ b/ente/kustomization.yaml
@@ -13,10 +13,10 @@ images:
     newTag: latest
     digest: sha256:08b6fd823efc15a38592a808840012a7ad13cccb645f88dfe981c50fcca8798a
   - name: photos
-    newName: code.icb4dc0.de/infrastructure/images/ente/photos
+    newName: registry.icb4dc0.de/infrastructure/ente/photos
     newTag: v0.9.99
   - name: cast
-    newName: code.icb4dc0.de/infrastructure/images/ente/cast
+    newName: registry.icb4dc0.de/infrastructure/ente/cast
     newTag: v0.9.99
 
 labels:
@@ -27,6 +27,7 @@ labels:
 
 resources:
   - resources/namespace.yaml
+  - resources/secret.harbor-credentials.yaml
   - resources/museum/db/db.yaml
   - resources/museum/db/user.yaml
   - resources/museum/cache.yaml
diff --git a/ente/resources/cast/deployment.yaml b/ente/resources/cast/deployment.yaml
index c1fb4c8..4af1048 100644
--- a/ente/resources/cast/deployment.yaml
+++ b/ente/resources/cast/deployment.yaml
@@ -17,28 +17,30 @@ spec:
         app.kubernetes.io/part-of: ente
     spec:
       containers:
-      - name: cast
-        image: cast
-        imagePullPolicy: Always
-        env:
-          - name: ENDPOINT
-            value: https://api.ente.icb4dc0.de
-          - name: ALBUMS_ENDPOINT
-            value: https://albums.ente.icb4dc0.de
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "25m"
-          limits:
-            memory: "128Mi"
-            cpu: "50m"
-        ports:
-        - name: http
-          containerPort: 3000
-        readinessProbe:
-          httpGet:
-            port: 3000
-            path: /
-            scheme: HTTP
+        - name: cast
+          image: cast
+          imagePullPolicy: Always
+          env:
+            - name: ENDPOINT
+              value: https://api.ente.icb4dc0.de
+            - name: ALBUMS_ENDPOINT
+              value: https://albums.ente.icb4dc0.de
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "25m"
+            limits:
+              memory: "128Mi"
+              cpu: "50m"
+          ports:
+            - name: http
+              containerPort: 3000
+          readinessProbe:
+            httpGet:
+              port: 3000
+              path: /
+              scheme: HTTP
+      imagePullSecrets:
+        - name: harbor-registry-credentials
       nodeSelector:
-        kubernetes.io/arch: arm64
\ No newline at end of file
+        kubernetes.io/arch: arm64
diff --git a/ente/resources/photos/deployment.yaml b/ente/resources/photos/deployment.yaml
index 87e7425..bb41a55 100644
--- a/ente/resources/photos/deployment.yaml
+++ b/ente/resources/photos/deployment.yaml
@@ -17,28 +17,30 @@ spec:
         app.kubernetes.io/part-of: ente
     spec:
       containers:
-      - name: photos
-        image: photos
-        imagePullPolicy: Always
-        env:
-          - name: ENDPOINT
-            value: https://api.ente.icb4dc0.de
-          - name: ALBUMS_ENDPOINT
-            value: https://albums.ente.icb4dc0.de
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "25m"
-          limits:
-            memory: "128Mi"
-            cpu: "50m"
-        ports:
-        - name: http
-          containerPort: 3000
-        readinessProbe:
-          httpGet:
-            port: 3000
-            path: /
-            scheme: HTTP
+        - name: photos
+          image: photos
+          imagePullPolicy: Always
+          env:
+            - name: ENDPOINT
+              value: https://api.ente.icb4dc0.de
+            - name: ALBUMS_ENDPOINT
+              value: https://albums.ente.icb4dc0.de
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "25m"
+            limits:
+              memory: "128Mi"
+              cpu: "50m"
+          ports:
+            - name: http
+              containerPort: 3000
+          readinessProbe:
+            httpGet:
+              port: 3000
+              path: /
+              scheme: HTTP
+      imagePullSecrets:
+        - name: harbor-registry-credentials
       nodeSelector:
-        kubernetes.io/arch: arm64
\ No newline at end of file
+        kubernetes.io/arch: arm64
diff --git a/ente/resources/secret.harbor-credentials.yaml b/ente/resources/secret.harbor-credentials.yaml
new file mode 100644
index 0000000..ac48de2
Binary files /dev/null and b/ente/resources/secret.harbor-credentials.yaml differ