diff --git a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
index 4148549..15aab64 100644
--- a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
+++ b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
@@ -71,4 +71,14 @@ appSpec:
     nameOverride: contour
     namespace: projectcontour
     chartDir: contour
-    valuesDir: contour
\ No newline at end of file
+    valuesDir: contour
+  - name: external-secrets
+    # Fresh install, no existing release to adopt — no nameOverride
+    # needed. Replaces the Vault Agent Injector for pulling secrets into
+    # pods. This just brings the controller up; wiring a
+    # SecretStore/ClusterSecretStore to Vault as the actual backend is a
+    # separate step once this is healthy (needs a Kubernetes auth method
+    # enabled on the Vault side first).
+    namespace: external-secrets
+    chartDir: external-secrets
+    valuesDir: external-secrets
\ No newline at end of file