diff --git a/clusters/base/apps/mosquitto/secret.enc.yaml b/clusters/base/apps/mosquitto/secret.enc.yaml
index 1ceb08a..7cb0c3e 100644
--- a/clusters/base/apps/mosquitto/secret.enc.yaml
+++ b/clusters/base/apps/mosquitto/secret.enc.yaml
@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:n4mdp9w3mi5p3qcLORSPlsi6FWtBWJpX9OIVQ6UikgoQFRBRsqzmq7Cq8MBNtMxrYgdbNgb8OZ+sDnfYFZojl5dX24+Fjqq7SIyS5z0w7OPnvAjux7ABywnyPQA/rztt3qZDGqmBPOMUs3Au08dgvOgbPLGHMoaseKu8qtwNHDTQ6E1qXo8FjpFIJJODsBKOdxc0KOHdhpnxFPcsYKC8T5Lg7Qg0nE3p6mYJ1qiDkiSFI/nVFyAzVPnbM7ZCyg==,iv:CwMek58B8U3wxmmPNxTB5emMwmpiHmeg59Yr/LYr8bo=,tag:p3+lAVVpyhf1bnWDjOdbAg==,type:str]
+    passwd: ENC[AES256_GCM,data:xQSebjHsknzsxHOfFrpW7P5ARm3WcUlOtAh7L2SmMNOmVkSQInen1KeNs++wI50h2rGJC8ztYB1FshXvynV3SBUGXsYKYGzoJWRuqNyQUO5zotCrMA67MZFR3u8S5QIV+dDZSSq9pi/1gUYJ0wkw4QvM4C+sfDcuyIkpHwKLx1eHAtnJZam91IWUxVC3+pv8pe9I/bzbJuN9ovASYT3zplKI+9OhhrP+tssnmtI837u11PYq7uy103z3dXu3vQ==,iv:eduGICGVh8QnEWKeiz2EPNO45gVSaPKMsoSKIhRwMgU=,tag:v0oyyIGqD79Ow6zw2UzIGw==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UFh0QXBBVEpGR0F6d1Rj
-            RkhaMVpybDBzRTNJZzhwamJORlZFSHdSN3ljCmtBR0gyWHpxVDFBR2t1cStLWnla
-            bENBVW1yNHVMWXRqTXhYcEJXTjd0aWsKLS0tIFJBS2F3aEt0TkNiN0wzc3hGcTdE
-            eWUxb3VOTC9sMDliMnVwVm9XdXlHRm8KstZhKVC/wkhvF1d/mH7wZ44y5vo0vLYh
-            T38QGkjP3rUUpuyW/hppn7J5qdolRMyKyKIBqDJDIyMgmG3Hp0I4dQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTUZqZ3YvcEpxSXBLMG9J
+            RkJHcmZJS3RwV2tESzhOWUltLzh2VlVJdURJCmd1c1lQS2JQK1hNTVp1UGNYL0Fi
+            ZWxjL3h1a0lyU3ZDMGZqVHNPeTdTRjAKLS0tIFdCSGt1dDVqUnF3cTNYTmhNemZY
+            UGo1dDY3MVdsdGFKa0ZPWDVTWVBGTWcKpkUlWJ5gh1Gvc1Je0k9N6OYdNiIuMdWC
+            3BRJ9Pj3K2uBHDfXYjzGZZCuhD8WAyLTnvTC4sfm0MqrshUGrjEFbQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:25Z"
-    mac: ENC[AES256_GCM,data:rtOagU+o2Hvj8eXjN4vF/1QQTTq6PpcuD7H1ElZO0evwzqN2mqTX6p/MB7A8AQdEuRFkRlfsjruAsdcA8prMx9GrWeR8KMhtm6Lp/VFTN1aSqVdUTqmmY37rwiRVFF5Q/TrSf3sYuKcJCXbvvrb09i2+sA3WfDr10mMLEffrzTc=,iv:wQ9FXmceA0pjbmYN0Yga3+hQnULlkZP/aQ1IohmloOo=,tag:xsg4pFrI/0lAKSonZA2F+g==,type:str]
+    lastmodified: "2026-08-26T10:19:30Z"
+    mac: ENC[AES256_GCM,data:FRMpOYTHSJxbiTjWH8X3AYtXrpVBr1GzjPiSCezBgbQ7LtYfnj5/qxTF5kxKRdefvCYRH5+JumGTF4WdwiNJj2zjFv4rcUCG1YstA7sHur8Ya0VIWZTzCKrn6cdatnpKwfrYC5vuik7RuPwWkPm1lUQmiCKFPghm+owpusnZ0mA=,iv:unGqc5h+mIuZPyFMzcwX2+iGmm97JSY7JSJC9OsMzyk=,tag:wzuBFriM4lZwu7k+csCbfQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0
diff --git a/clusters/base/apps/radicale/helmrelease-agendav.yaml b/clusters/base/apps/radicale/helmrelease-agendav.yaml
new file mode 100644
index 0000000..bb56ab2
--- /dev/null
+++ b/clusters/base/apps/radicale/helmrelease-agendav.yaml
@@ -0,0 +1,60 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: agendav
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: radicale
+  values:
+    controllers:
+      agendav:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/nagimov/agendav-docker
+              tag: latest
+            env:
+              AGENDAV_SERVER_NAME: "127.0.0.1"
+              AGENDAV_TITLE: ""
+              AGENDAV_FOOTER: ""
+              AGENDAV_CALDAV_SERVER: "http://radicale.pim.svc.cluster.local:5232/%u"
+              AGENDAV_CALDAV_PUBLIC_URL: "https://c.aggtaa.com/server"
+              AGENDAV_TIMEZONE: "Europe/Moscow"
+              AGENDAV_WEEKSTART: "1"
+              AGENDAV_LANG: "en"
+              AGENDAV_LOG_DIR: "/tmp/"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: agendav
+        ports:
+          http:
+            port: 8080
+
+    ingress:
+      app:
+        className: traefik
+        # no cert-manager annotation here: radicale's own Ingress already
+        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
+        # A second Ingress with the annotation would create a competing
+        # Certificate for the same host/secret.
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
diff --git a/clusters/base/apps/radicale/helmrelease.yaml b/clusters/base/apps/radicale/helmrelease-radicale.yaml
similarity index 100%
rename from clusters/base/apps/radicale/helmrelease.yaml
rename to clusters/base/apps/radicale/helmrelease-radicale.yaml
diff --git a/clusters/base/apps/radicale/kustomization.yaml b/clusters/base/apps/radicale/kustomization.yaml
index eae78ac..223967c 100644
--- a/clusters/base/apps/radicale/kustomization.yaml
+++ b/clusters/base/apps/radicale/kustomization.yaml
@@ -4,5 +4,6 @@ resources:
   - helmrepository.yaml
   - secret.enc.yaml
   - configmap.yaml
-  - helmrelease.yaml
   - middleware.yaml
+  - helmrelease-radicale.yaml
+  - helmrelease-agendav.yaml
diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml
index 7e7357c..4236e1d 100644
--- a/clusters/base/apps/vaultwarden/secret.enc.yaml
+++ b/clusters/base/apps/vaultwarden/secret.enc.yaml
@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:aOrabCMOFGxGscMonlTLjLuO+oZ5f3H4ZzHz4yarRRD9DSeq4wUISIP0jyZlV6LAM4J/ZBeKKXBm,iv:HgsaT40RJrLk5pA8xEsIS+kwE7G0rRYP5wffysU890E=,tag:DmcpYggAlJHhCsy6IA0oiw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:XhnHFoQPsNe4ZdNHQow/TB7yezmSS/VP6ymdGian2HApQ0WTJZVDtJys9xbxsLOqjGVs8q43NOnnWjdZg/8rPDbEbULmNf+8ZrjvbnE4OHI+RBwox91DiKbtmvVCjR598lTsITMoA9U4RmUX4z+rEHXm1jNU+w==,iv:5zop46xOQVFj3eqK3bIOSRWzFoGxQlyS3X5P50zl9+Q=,tag:k3fzsDsTbiMWoPsIdthdOQ==,type:str]
+    #ENC[AES256_GCM,data:7z36354PwQmd4kVLiqY2MzCB55M2W1NZaFkE7uL6GUyjLbCMq57zHP3zy3rMAgnlI1r9gKmJvT1M,iv:yEKxT6I/Gm/jAjTrmgZbo1V6Ep2H2J0cz3LwCRME9fc=,tag:+or+hvluMSI2WlAA7Bi5GQ==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:+0wDgw4aCy9y+lVf3roFK18EfVBiMQk2bdRSK4gONlfPNtaS7OqxLvlUTcf/tX7pqVXUKRj9/KcOzNJsfbSDDq+mDHcHpu1sXBoqSsTE1l5p7T8v4l8HSJZ2CsXPZ050nvmWP/1MfOVMq4Ze7O+lMWmN89DnUw==,iv:3B/ju/wkrG311ld4GksXlFydj3C3bmbzKCE/mrUyo2U=,tag:ZvwXqmnExhF55/4Y4w8nqg==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ekhNdnZXc2hwd2FmM1JE
-            Nndud0w3SExXaEU1cVNkVTlzUDEwMXBpeWp3Cjh2WVV5ejI1N0E4NUE2K3ltNnp2
-            NnRwWHpoNzMrVldtOW9kblEzWVN4aXMKLS0tIHNPNkxHK2d0STRKVGVGR3NQZUZp
-            ZVpNQ1MxSHQwRUt0STR1SlJHTUJYcUUKpqPSMk/ASYOMjC/0WfNmOuIIk9hbGbSw
-            tyrrlFTSgWs0qidKSxbBY61mHwWLyj2G1E7x3mzbMFcIZIJM5lsjlA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNWlh4ZG5aenhSbi91NnAw
+            VUs2SXBsaTgrREFFaUFFWE5zcCtBTUQ0MFdzCkhzWWNTUU9ZSWNYME5xUTg4WFp1
+            UXY5djlkaFRVOXV5ZitkZDMzQjJxN00KLS0tICtTS3lVTXBLdUtnYk9JckQ1TitY
+            NXZpZUpGWlI0TXZEc0RqOE16bmdGeXcKDDDpyVm2VOnpk++E8v1mfBJwJn7B/kej
+            zTXgKaxwxDOEC4fvYTOBL49yoFRMd4idGVlDGXTBrhvrA1MP0yoD2g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:26Z"
-    mac: ENC[AES256_GCM,data:wHHZzm/Tqvv3BfOAaLESs3spxKJcFeD60BGFNFIxTFz+M2xnmsYJwKgJwnx9/pEt77PhvqfAp9agsy0Zlh0JS4DQFv971/MN3MnJcT0Tfcv8Zf3A6cSezEvvSu1vo5VRbzKFcIDC1hHYIadlkgSrMF7v+AvOjKBd8noB0903QKw=,iv:jP52nrm1x9Gr938Bz/eUjMciGw1oROECkWA4CX6HQpI=,tag:+Gyomr3zWwiZLrJtfQKSSw==,type:str]
+    lastmodified: "2026-08-26T10:19:31Z"
+    mac: ENC[AES256_GCM,data:vjZOoGqVsUWIZYIPEycyUr5bCjbzxQx25SpO5PVncqsdlfy43b2wby498eLHvNmDh6vuMRNdJCJiQZnKy72MAgE5adGDDazpDP8qvvhjdfaQgjvhUSbPOdI+BdyhnYtfcnjybEq13URyZm1wNd/zDgq24gCOPAuRNxpvKdBOMKc=,iv:/5Do7ctC7lDEJuMAQkHU6HCHAWc3fo6HJzK+8G51NFE=,tag:llmtcOFlUMVjQU+X05R75A==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0
diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
index b117029..2e0dc1b 100644
--- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
+++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml
@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:cng7u7VcxOi1zQpZaxHaTzgUcDj6y6YeQbIuvz54cxi7hRmetw+OkT41zeiPNRVuSiJDzwdiWDuIlc4CGAJoE/vk0hQLeVKBPxD51MSz8jF0ywHe3sga0emR2Mdjun9vTPFLDFu4tx8ttom4LaTXTFnve2eTZ5a3WHUg1ck=,iv:YqWMZBjjisRUfNVg8I7M2LC65MHHx3NdZkSRcsAWO38=,tag:WJafLvGi9AcxWLSF25GgTA==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:+wzWl7/j4trMG/uaildOcAxmDAlSpHig6F42FvksMq9ZGK04yLKa4Tprsx0QhcIJ9zdZuA92dJuuTsIZvBZVXtARUEiNfEWcqDIf+fD5yZoYv0ZnW2Gi6/hGFefmXoycEYGoR4o6kvDwer37xj/VFtieueDdYlLW3W4iooE=,iv:/e2rWq7jPqtetmP3qmOHz6/y0fekjZA0kbh41Fp/J+0=,tag:Ijhz2S7lcxzvPvukNhi8eg==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSnROSjg4Y3JNa1N6c2dC
-            eGd0ZWZyZXlWU0RxOURHQ0FFZ1lxWGpUZFV3CmY5UGtGbEE0THVKOFdHejRDemdU
-            aGk5eW1EZ1JhWERremw1NHR5NGFrMncKLS0tIEhOTXYyaXlZMVAwNXFUNExNNkpB
-            SmIzWDdCOGtGUnppK0RvRUE2T2lDNHMK9hbM7OGSQNNmkL6Y336U/mFt0oES11ZA
-            D/VK/CCvdVPI2vabRlKhRlnpkzlnwCFR8l8K1rMkIR47Dk1khAX1ig==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCMXBobi9nWmhETnpSUFIw
+            cXExbGYxRUZMRHc0ODJ1NFNTQlZ2YnJBbVFnCktnZDlFcEhmeStSaGZ3elEvMlJJ
+            ajRtOHlOWjJSMm5CWWErZjRkeXhCSXMKLS0tIEYzR1FkWEprM2NGaVpWS29Jd1ZX
+            Y21hR0x5S1VKZU5UamZuTXN3amVNRjAKmCQVcCABiBQtPLtRVe/kV6AJkEQmDp7E
+            OcIto/QH0wPb97zEEgVIy5/XNittwWMdWxPv5a62TPsIfOIHngN43g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:27Z"
-    mac: ENC[AES256_GCM,data:Z/vPgy/SfB8ev5oG+Ox2+xt0l4xarV59pHdFlP/umprNmQylgsxglVaWwcgA6PAqQm6IW1tjrIvWNLevZ3TahoB0FO83uFPJtzc9u78GBRaAbNW7ME3SrgHmhNiEEbbZdsOz0thhvor7xjggtzQrcSC20TWHzITzcUS3d6wlRXA=,iv:dm8XxXkPZBmoYcPBLu5Hj7FcZ+PFkbE3PSMNowQYzPU=,tag:YPLSCDAM5PhzCyQgJftIPg==,type:str]
+    lastmodified: "2026-08-26T10:19:32Z"
+    mac: ENC[AES256_GCM,data:Dq5volCysajK/rCkAD5bIwo1gqDSnNum5nCreQ4NteZV4GbKjRGpFhjKptD8vw6KF1qr7anTjMB///UL/vq45AiGj6TQWPi3a8PCqV4Jw0+NN8ZbU5tPlqYDqveTIAp1OmgxIks92I+0aCJVHXWbIaBU8MFfl3UsyqF95/qnIHc=,iv:jN2O866YMT2lS3+hv1tkT/POJFQkN8ufrelXGwJCWVY=,tag:t4G/ufMdZF8aijqX/uleZw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0