diff --git a/clusters/base/apps/radicale/helmrelease.yaml b/clusters/base/apps/radicale/helmrelease.yaml
index 133ce34..d870040 100644
--- a/clusters/base/apps/radicale/helmrelease.yaml
+++ b/clusters/base/apps/radicale/helmrelease.yaml
@@ -5,13 +5,9 @@ metadata:
   namespace: pim
 spec:
   interval: 10m
-  chart:
-    spec:
-      chart: radicale
-      sourceRef:
-        kind: HelmRepository
-        name: radicale
-        namespace: pim
+  chartRef:
+    kind: OCIRepository
+    name: radicale-app-template
   values:
     controllers:
       radicale:
diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml
index ce56de9..4e9698e 100644
--- a/clusters/base/apps/vaultwarden/secret.enc.yaml
+++ b/clusters/base/apps/vaultwarden/secret.enc.yaml
@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:orNisgwofNsYurSbfM5T8lImdmGiNlyqSHS4yNxhvVp8Pt2fJCGBDUhFvj/KXds28hiit7h2W7ZC,iv:PYRnV4fdZO8D0Gh7L9cF1XRRncQtYjUMMQeROkJtLdE=,tag:CzNN1sc2j81lxum24q22cQ==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:lP7OwkeWM4JoPGEjy6KIu2Bzlui1MFX5fhkjLlhjvuYRtBncWGA/Qw942f8wM6nJ4yG5cHmhBAoBN5HXtcVAHT6IHB6zu1+u+Js3Xxi/zwUYbjOaoET0wwpOyjb11FJiVxfDQaXFrZRELaf3u2PiqLgTxvcYCQ==,iv:onVSYsmA+/AVfoX07YkOK/gTG/tKoZCorEzedL6K7RI=,tag:PV3j1sJVwPurhr4nCYxS4w==,type:str]
+    #ENC[AES256_GCM,data:lKR/CGxXgmMbb62XuP2BVCJLMCjxhmtWg8ZxybF5FzlB9xFQTalu3qHSMsf6IBhnI7bLVM88DwO1,iv:nXY9zYBuTHD2q0P3cjA6xuHJb/q2XWgD2p7ubZiu8R8=,tag:B6sAF5wfgY7XFWxCTVp5vw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:9NGY+zXfRlPBBYdOYxVEFrITvPRucaKYBAXb4RVHoTKNKGHWfp/wdavSRtCP0ef4IS6ngZJFVvGg20OyQXitL6XyYWRpnNaGzUj+0RdnabHzzz0q/o7F0Iig7J5KxrKlqQB2lWQLAuaAEdPH8fCDQ8YIRM5PIg==,iv:UJEDZC/RIcjjrFpPHAQhqpsH2HSuDT7hJ9x969PDQh4=,tag:Dh29FxjN8tP7wQO3ohWGgA==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnd3lBZXV1QXVSVU9YRFVW
-            bEVuZmFONUcrNXpLYmVTNmdGZkFXOFcvQUZBCm1PejIwUDNUUG54NzR0c2tuTFVr
-            eUtJK0d3bk9jUjBNSTBkazlMZ1V4VDgKLS0tIGRLbzdqK2lNcmpWbWUvTXgrUlJI
-            QS82NjcwWjEyY3FCc09HRXFYa1JMWnMKg3vrdLj3VkAwm+8+xoIf/Mj/KzZqJr6e
-            J+obcI9CX3FL3GM1XoJODdqUAXppzMgcZGYcmDka9E/0xLWq9WzjtQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UCt5N0ZOSElDK3Rqc1ZX
+            UFJhUERPZkE3VUZ4cVk4dlRyOHUzTjViZWg0CkN3a3lETFZSRVphbmk4SEkxTjl0
+            MUI0Y09zbWJNK3VxVFhSZHRYMWErOVEKLS0tIFZFeFFSeVFjZFVPcGlqRXFUY0g0
+            dm5qKzJHSjQ4bE45SFUzTHBHMXpmVDAKdBZcmi6+XEGzaskLqxGcenvMTe36xUXI
+            5+TOln06WWCSZO+PgIYrCpz83SNQSfZMB4xn10jfoTiagaaK5yh3Ww==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:46Z"
-    mac: ENC[AES256_GCM,data:sqbFh8XtF/dHugeAzvqAJZAjJ59LqnSJ7fLmCgijaCPamwz92/gT3a6rUhwNfvSyP0OR/LwDZ00NOF6pGbhoReEWoo1fUh+tv745wutmQzQwOi0lOpMY4cP2LZjX3gegI0ZRyTNXXsgvxZnKmQwezaGPd0KHCaFq0cXHPuxUR3k=,iv:z6eqkPpw3IaAxrbIdLut8yIkk7AtLCBMBDoGSSYXeb0=,tag:MMH1kt8fDzCVagcMqG9YCg==,type:str]
+    lastmodified: "2026-08-26T10:18:49Z"
+    mac: ENC[AES256_GCM,data:jT3eNOHBRsYPgiHv5lcBgcef0E6Eke4F8FQ1DTfJpEIKU9TUX4bUGly/AkcKmTMELSyzjL4eP62M6aN3tvRWzTWxmqOcRj1f/4INaFzrXLNFb5A564AWWlX2c3RIBD9D+oee3D7ufzIvzIt8M9O0/BEAeC2+novqFOyirQQuj8c=,iv:/pl6DZeZ7UMDDKAikJ6qc2OsEzW72BDa4523pjcRP/Q=,tag:XnW+184AhrFjFSe3aZGJew==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0
diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
index 52a5183..cd3caaa 100644
--- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
+++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:sj1MPQCs2mbLD9g7vqA/wyXjLqcKoI4A56joY63fb2K21IFEgzA+SzuQz4wg8wd/SeWUi/6KI6i7v9KenpMtcQ54X9fcl4i0Sxj/Pw/o/xbOKFRUG2m9Jo27M5GFTbuktZfgdauoVn1BO2gbgJyOCDtIcuE37YmNrfLTFKQ=,iv:Oxv+PXkZE6EKv2NAzUUSSoDwB1FLpLSZGPsQ156ARE8=,tag:D9vhMz5fI7lat44H/dJdRg==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:5PEBioc3Ldh59/HLwi1/DvU3G695IbQ175fCZ9e/139vNXTMOe04aC7ToEbzVAtpYD+lxddUtuGu67+mjhntT3MSqL6nZ1Ki7T02jENmK+wH5Xf2OOCCbvfXLIhTVsUBQt4/aZCzmsEzrfvBi6WtEzrG/hrHvcNb40BkfSE=,iv:vCc/8oUhen5+TnQyG6OZkTD1T8Fm7Tp2h3uK3EBYsd8=,tag:umdYrAl1MrURNWKvdUR6Vg==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIc0VQeVNWTWtUcEJNQU1a
-            SnVaNjhNVWlnSDBZakI1aU9mbHJRbVdQajNFClBMdy9saGhZS2gzMmtyRkU4T3hM
-            ZDRidUJHdzRQdGZzVGVCWG44U0w3YkUKLS0tIFFHMm52Tmw1Tkgrd3UwSHpnSlJ4
-            VjZscXRaT3JXSWhuS0V1a09YQWo2QkUK8/IZRvCIBwb+Cg3EosJqIjtf5D+QlYoQ
-            ZDxirxxefHtfxwQfOg4YqGTkfURcjSs+zkM4H1GTlrg3mUnk/5T0mg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwcUY4Rm5sYkJtZWpuUWY4
+            SnNHR2xnQkhDdjhjdVovZ1FFWTgyM3hES0ZVCnRHZmN1bWF6QTM0RjNJVEQ5ZkZj
+            V3lHd0N6WTNhUmhZbU03R29KbXRoVXMKLS0tIGVNL1ptV0FJUmFxNXBMRjhTVm8x
+            RUNFblg2SVFJK0Nscm9nRFBWelFldkEK55UJ+wLLlrTjDmVy9WOJplw8k6cDV2as
+            v3S0lHNU5u8LOjVt2qQ3JM1fKDjtuMm1QTbMvOWoun+RgvZOmjLXCg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:47Z"
-    mac: ENC[AES256_GCM,data:rj5tZQe1vqUdDMSCDsptarzAM220rQGaqWBxDRVGObf0W4vQvP3wJLnH2VFej1jZc0A6ZNWMrPGN1xu5Vla/Kgm3pBMqVvJSKgYefmV+UFxX4wdF/4Xncb5PL2S0sHUXZY787oWEd4JPWi1I9kiaTvhcylMQUSRQK8/qmtXO3VQ=,iv:2XeQ3RhfnYakXci2U6D9UjPcemqx7xaJ8I+WhWK8Al4=,tag:ahodpT8MFdAOaPRj/OUkFA==,type:str]
+    lastmodified: "2026-08-26T10:18:50Z"
+    mac: ENC[AES256_GCM,data:zNVQ0kCZL2eJi1mOR5UFY2nGBzbuHiOiiu/jpchmZkScrUsoLrIGDW/m3xwsIuu5y9AgQYEIxtIZ3fXQHX6fAYdaHUsEKCv+pz81gBNTTDzdNbvMenftZMXfKFsbpYoEo5VKREKSjPzy4KjCthLAmCRACvQi1K7sZqw40iF3XtE=,iv:OyYo5c/5wOmjSCop9ahqLZiwjNh1tPmMN4RWkISRBPg=,tag:pSvt/C870sWi9XIt5cJbVw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0