From bc57fb5b9ed2548c4cc48c24b2467a2916d5bf7d Mon Sep 17 00:00:00 2001
From: gitea-bot <gitea-bot@alexlebens.net>
Date: Sat, 25 Apr 2026 01:11:24 +0000
Subject: [PATCH] chore: Update manifests after change

---
 ...ackrest-config-backup-secret-external.yaml | 37 +++++++------------
 ...t-backrest-config-backup-secret-local.yaml | 37 +++++++------------
 ...-backrest-config-backup-secret-remote.yaml | 37 +++++++------------
 ...-backrest-data-backup-secret-external.yaml | 37 +++++++------------
 ...ret-backrest-data-backup-secret-local.yaml | 37 +++++++------------
 ...et-backrest-data-backup-secret-remote.yaml | 37 +++++++------------
 ...ackrest-config-backup-source-external.yaml |  4 +-
 ...e-backrest-config-backup-source-local.yaml |  4 +-
 ...-backrest-config-backup-source-remote.yaml |  4 +-
 ...-backrest-data-backup-source-external.yaml |  4 +-
 ...rce-backrest-data-backup-source-local.yaml |  4 +-
 ...ce-backrest-data-backup-source-remote.yaml |  4 +-
 ...-bazarr-config-backup-secret-external.yaml | 37 +++++++------------
 ...ret-bazarr-config-backup-secret-local.yaml | 37 +++++++------------
 ...et-bazarr-config-backup-secret-remote.yaml | 37 +++++++------------
 ...-bazarr-config-backup-source-external.yaml |  4 +-
 ...rce-bazarr-config-backup-source-local.yaml |  4 +-
 ...ce-bazarr-config-backup-source-remote.yaml |  4 +-
 ...awarich-public-backup-secret-external.yaml | 37 +++++++------------
 ...t-dawarich-public-backup-secret-local.yaml | 37 +++++++------------
 ...-dawarich-public-backup-secret-remote.yaml | 37 +++++++------------
 ...warich-storage-backup-secret-external.yaml | 37 +++++++------------
 ...-dawarich-storage-backup-secret-local.yaml | 37 +++++++------------
 ...dawarich-storage-backup-secret-remote.yaml | 37 +++++++------------
 ...warich-watched-backup-secret-external.yaml | 37 +++++++------------
 ...-dawarich-watched-backup-secret-local.yaml | 37 +++++++------------
 ...dawarich-watched-backup-secret-remote.yaml | 37 +++++++------------
 ...awarich-public-backup-source-external.yaml |  4 +-
 ...e-dawarich-public-backup-source-local.yaml |  4 +-
 ...-dawarich-public-backup-source-remote.yaml |  4 +-
 ...warich-storage-backup-source-external.yaml |  4 +-
 ...-dawarich-storage-backup-source-local.yaml |  4 +-
 ...dawarich-storage-backup-source-remote.yaml |  4 +-
 ...warich-watched-backup-source-external.yaml |  4 +-
 ...-dawarich-watched-backup-source-local.yaml |  4 +-
 ...dawarich-watched-backup-source-remote.yaml |  4 +-
 ...-foldergram-db-backup-secret-external.yaml | 37 +++++++------------
 ...ret-foldergram-db-backup-secret-local.yaml | 37 +++++++------------
 ...et-foldergram-db-backup-secret-remote.yaml | 37 +++++++------------
 ...-foldergram-db-backup-source-external.yaml |  4 +-
 ...rce-foldergram-db-backup-source-local.yaml |  4 +-
 ...ce-foldergram-db-backup-source-remote.yaml |  4 +-
 ...-freshrss-data-backup-secret-external.yaml | 37 +++++++------------
 ...ret-freshrss-data-backup-secret-local.yaml | 37 +++++++------------
 ...et-freshrss-data-backup-secret-remote.yaml | 37 +++++++------------
 ...-freshrss-data-backup-source-external.yaml |  4 +-
 ...rce-freshrss-data-backup-source-local.yaml |  4 +-
 ...ce-freshrss-data-backup-source-remote.yaml |  4 +-
 ...alSecret-gatus-backup-secret-external.yaml | 37 +++++++------------
 ...ernalSecret-gatus-backup-secret-local.yaml | 37 +++++++------------
 ...rnalSecret-gatus-backup-secret-remote.yaml | 37 +++++++------------
 ...onSource-gatus-backup-source-external.yaml |  4 +-
 ...ationSource-gatus-backup-source-local.yaml |  4 +-
 ...tionSource-gatus-backup-source-remote.yaml |  4 +-
 ...ea-shared-storage-backup-secret-local.yaml | 37 +++++++------------
 ...ea-shared-storage-backup-source-local.yaml |  4 +-
 ...rimmory-config-backup-secret-external.yaml | 37 +++++++------------
 ...t-grimmory-config-backup-secret-local.yaml | 37 +++++++------------
 ...-grimmory-config-backup-secret-remote.yaml | 37 +++++++------------
 ...rimmory-config-backup-source-external.yaml |  4 +-
 ...e-grimmory-config-backup-source-local.yaml |  4 +-
 ...-grimmory-config-backup-source-remote.yaml |  4 +-
 ...sistant-config-backup-secret-external.yaml | 37 +++++++------------
 ...-assistant-config-backup-secret-local.yaml | 37 +++++++------------
 ...assistant-config-backup-secret-remote.yaml | 37 +++++++------------
 ...sistant-config-backup-source-external.yaml |  4 +-
 ...-assistant-config-backup-source-local.yaml |  4 +-
 ...assistant-config-backup-source-remote.yaml |  4 +-
 ...-houndarr-data-backup-secret-external.yaml | 37 +++++++------------
 ...ret-houndarr-data-backup-secret-local.yaml | 37 +++++++------------
 ...et-houndarr-data-backup-secret-remote.yaml | 37 +++++++------------
 ...-houndarr-data-backup-source-external.yaml |  4 +-
 ...rce-houndarr-data-backup-source-local.yaml |  4 +-
 ...ce-houndarr-data-backup-source-remote.yaml |  4 +-
 ...lSecret-immich-backup-secret-external.yaml | 37 +++++++------------
 ...rnalSecret-immich-backup-secret-local.yaml | 37 +++++++------------
 ...nalSecret-immich-backup-secret-remote.yaml | 37 +++++++------------
 ...nSource-immich-backup-source-external.yaml |  4 +-
 ...tionSource-immich-backup-source-local.yaml |  4 +-
 ...ionSource-immich-backup-source-remote.yaml |  4 +-
 ...ellyfin-config-backup-secret-external.yaml | 37 +++++++------------
 ...t-jellyfin-config-backup-secret-local.yaml | 37 +++++++------------
 ...-jellyfin-config-backup-secret-remote.yaml | 37 +++++++------------
 ...ellyfin-config-backup-source-external.yaml |  4 +-
 ...e-jellyfin-config-backup-source-local.yaml |  4 +-
 ...-jellyfin-config-backup-source-remote.yaml |  4 +-
 ...jellystat-data-backup-secret-external.yaml | 37 +++++++------------
 ...et-jellystat-data-backup-secret-local.yaml | 37 +++++++------------
 ...t-jellystat-data-backup-secret-remote.yaml | 37 +++++++------------
 ...jellystat-data-backup-source-external.yaml |  4 +-
 ...ce-jellystat-data-backup-source-local.yaml |  4 +-
 ...e-jellystat-data-backup-source-remote.yaml |  4 +-
 ...ecret-karakeep-backup-secret-external.yaml | 37 +++++++------------
 ...alSecret-karakeep-backup-secret-local.yaml | 37 +++++++------------
 ...lSecret-karakeep-backup-secret-remote.yaml | 37 +++++++------------
 ...ource-karakeep-backup-source-external.yaml |  4 +-
 ...onSource-karakeep-backup-source-local.yaml |  4 +-
 ...nSource-karakeep-backup-source-remote.yaml |  4 +-
 ...et-komodo-keys-backup-secret-external.yaml | 37 +++++++------------
 ...ecret-komodo-keys-backup-secret-local.yaml | 37 +++++++------------
 ...cret-komodo-keys-backup-secret-remote.yaml | 37 +++++++------------
 ...ce-komodo-keys-backup-source-external.yaml |  4 +-
 ...ource-komodo-keys-backup-source-local.yaml |  4 +-
 ...urce-komodo-keys-backup-source-remote.yaml |  4 +-
 ...guagetool-data-backup-secret-external.yaml | 37 +++++++------------
 ...languagetool-data-backup-secret-local.yaml | 37 +++++++------------
 ...anguagetool-data-backup-secret-remote.yaml | 37 +++++++------------
 ...guagetool-data-backup-source-external.yaml |  4 +-
 ...languagetool-data-backup-source-local.yaml |  4 +-
 ...anguagetool-data-backup-source-remote.yaml |  4 +-
 ...ecret-libation-backup-secret-external.yaml | 37 +++++++------------
 ...alSecret-libation-backup-secret-local.yaml | 37 +++++++------------
 ...lSecret-libation-backup-secret-remote.yaml | 37 +++++++------------
 ...ource-libation-backup-source-external.yaml |  4 +-
 ...onSource-libation-backup-source-local.yaml |  4 +-
 ...nSource-libation-backup-source-remote.yaml |  4 +-
 ...-lidarr-config-backup-secret-external.yaml | 37 +++++++------------
 ...ret-lidarr-config-backup-secret-local.yaml | 37 +++++++------------
 ...et-lidarr-config-backup-secret-remote.yaml | 37 +++++++------------
 ...-lidarr-config-backup-source-external.yaml |  4 +-
 ...rce-lidarr-config-backup-source-local.yaml |  4 +-
 ...ce-lidarr-config-backup-source-remote.yaml |  4 +-
 ...atrix-hookshot-backup-secret-external.yaml | 37 +++++++------------
 ...t-matrix-hookshot-backup-secret-local.yaml | 37 +++++++------------
 ...-matrix-hookshot-backup-secret-remote.yaml | 37 +++++++------------
 ...matrix-synapse-backup-secret-external.yaml | 37 +++++++------------
 ...et-matrix-synapse-backup-secret-local.yaml | 37 +++++++------------
 ...t-matrix-synapse-backup-secret-remote.yaml | 37 +++++++------------
 ...autrix-discord-backup-secret-external.yaml | 37 +++++++------------
 ...t-mautrix-discord-backup-secret-local.yaml | 37 +++++++------------
 ...-mautrix-discord-backup-secret-remote.yaml | 37 +++++++------------
 ...utrix-whatsapp-backup-secret-external.yaml | 37 +++++++------------
 ...-mautrix-whatsapp-backup-secret-local.yaml | 37 +++++++------------
 ...mautrix-whatsapp-backup-secret-remote.yaml | 37 +++++++------------
 ...atrix-hookshot-backup-source-external.yaml |  4 +-
 ...e-matrix-hookshot-backup-source-local.yaml |  4 +-
 ...-matrix-hookshot-backup-source-remote.yaml |  4 +-
 ...matrix-synapse-backup-source-external.yaml |  4 +-
 ...ce-matrix-synapse-backup-source-local.yaml |  4 +-
 ...e-matrix-synapse-backup-source-remote.yaml |  4 +-
 ...autrix-discord-backup-source-external.yaml |  4 +-
 ...e-mautrix-discord-backup-source-local.yaml |  4 +-
 ...-mautrix-discord-backup-source-remote.yaml |  4 +-
 ...utrix-whatsapp-backup-source-external.yaml |  4 +-
 ...-mautrix-whatsapp-backup-source-local.yaml |  4 +-
 ...mautrix-whatsapp-backup-source-remote.yaml |  4 +-
 ...medialyze-data-backup-secret-external.yaml | 37 +++++++------------
 ...et-medialyze-data-backup-secret-local.yaml | 37 +++++++------------
 ...t-medialyze-data-backup-secret-remote.yaml | 37 +++++++------------
 ...medialyze-data-backup-source-external.yaml |  4 +-
 ...ce-medialyze-data-backup-source-local.yaml |  4 +-
 ...e-medialyze-data-backup-source-remote.yaml |  4 +-
 ...c-grabber-data-backup-secret-external.yaml | 37 +++++++------------
 ...usic-grabber-data-backup-secret-local.yaml | 37 +++++++------------
 ...sic-grabber-data-backup-secret-remote.yaml | 37 +++++++------------
 ...c-grabber-data-backup-source-external.yaml |  4 +-
 ...usic-grabber-data-backup-source-local.yaml |  4 +-
 ...sic-grabber-data-backup-source-remote.yaml |  4 +-
 ...navidrome-data-backup-secret-external.yaml | 37 +++++++------------
 ...et-navidrome-data-backup-secret-local.yaml | 37 +++++++------------
 ...t-navidrome-data-backup-secret-remote.yaml | 37 +++++++------------
 ...navidrome-data-backup-source-external.yaml |  4 +-
 ...ce-navidrome-data-backup-source-local.yaml |  4 +-
 ...e-navidrome-data-backup-source-remote.yaml |  4 +-
 ...llama-web-data-backup-secret-external.yaml | 37 +++++++------------
 ...t-ollama-web-data-backup-secret-local.yaml | 37 +++++++------------
 ...-ollama-web-data-backup-secret-remote.yaml | 37 +++++++------------
 ...llama-web-data-backup-source-external.yaml |  4 +-
 ...e-ollama-web-data-backup-source-local.yaml |  4 +-
 ...-ollama-web-data-backup-source-remote.yaml |  4 +-
 ...t-outline-data-backup-secret-external.yaml | 37 +++++++------------
 ...cret-outline-data-backup-secret-local.yaml | 37 +++++++------------
 ...ret-outline-data-backup-secret-remote.yaml | 37 +++++++------------
 ...e-outline-data-backup-source-external.yaml |  4 +-
 ...urce-outline-data-backup-source-local.yaml |  4 +-
 ...rce-outline-data-backup-source-remote.yaml |  4 +-
 ...ss-ngx-consume-backup-secret-external.yaml | 37 +++++++------------
 ...rless-ngx-consume-backup-secret-local.yaml | 37 +++++++------------
 ...less-ngx-consume-backup-secret-remote.yaml | 37 +++++++------------
 ...rless-ngx-data-backup-secret-external.yaml | 37 +++++++------------
 ...aperless-ngx-data-backup-secret-local.yaml | 37 +++++++------------
 ...perless-ngx-data-backup-secret-remote.yaml | 37 +++++++------------
 ...ess-ngx-export-backup-secret-external.yaml | 37 +++++++------------
 ...erless-ngx-export-backup-secret-local.yaml | 37 +++++++------------
 ...rless-ngx-export-backup-secret-remote.yaml | 37 +++++++------------
 ...less-ngx-media-backup-secret-external.yaml | 37 +++++++------------
 ...perless-ngx-media-backup-secret-local.yaml | 37 +++++++------------
 ...erless-ngx-media-backup-secret-remote.yaml | 37 +++++++------------
 ...ss-ngx-consume-backup-source-external.yaml |  4 +-
 ...rless-ngx-consume-backup-source-local.yaml |  4 +-
 ...less-ngx-consume-backup-source-remote.yaml |  4 +-
 ...rless-ngx-data-backup-source-external.yaml |  4 +-
 ...aperless-ngx-data-backup-source-local.yaml |  4 +-
 ...perless-ngx-data-backup-source-remote.yaml |  4 +-
 ...ess-ngx-export-backup-source-external.yaml |  4 +-
 ...erless-ngx-export-backup-source-local.yaml |  4 +-
 ...rless-ngx-export-backup-source-remote.yaml |  4 +-
 ...less-ngx-media-backup-source-external.yaml |  4 +-
 ...perless-ngx-media-backup-source-local.yaml |  4 +-
 ...erless-ngx-media-backup-source-remote.yaml |  4 +-
 ...-postiz-config-backup-secret-external.yaml | 37 +++++++------------
 ...ret-postiz-config-backup-secret-local.yaml | 37 +++++++------------
 ...et-postiz-config-backup-secret-remote.yaml | 37 +++++++------------
 ...postiz-uploads-backup-secret-external.yaml | 37 +++++++------------
 ...et-postiz-uploads-backup-secret-local.yaml | 37 +++++++------------
 ...t-postiz-uploads-backup-secret-remote.yaml | 37 +++++++------------
 ...-postiz-config-backup-source-external.yaml |  4 +-
 ...rce-postiz-config-backup-source-local.yaml |  4 +-
 ...ce-postiz-config-backup-source-remote.yaml |  4 +-
 ...postiz-uploads-backup-source-external.yaml |  4 +-
 ...ce-postiz-uploads-backup-source-local.yaml |  4 +-
 ...e-postiz-uploads-backup-source-remote.yaml |  4 +-
 ...rowlarr-config-backup-secret-external.yaml | 37 +++++++------------
 ...t-prowlarr-config-backup-secret-local.yaml | 37 +++++++------------
 ...-prowlarr-config-backup-secret-remote.yaml | 37 +++++++------------
 ...rowlarr-config-backup-source-external.yaml |  4 +-
 ...e-prowlarr-config-backup-source-local.yaml |  4 +-
 ...-prowlarr-config-backup-source-remote.yaml |  4 +-
 ...nt-config-data-backup-secret-external.yaml | 37 +++++++------------
 ...rrent-config-data-backup-secret-local.yaml | 37 +++++++------------
 ...rent-config-data-backup-secret-remote.yaml | 37 +++++++------------
 ...ge-config-data-backup-secret-external.yaml | 37 +++++++------------
 ...anage-config-data-backup-secret-local.yaml | 37 +++++++------------
 ...nage-config-data-backup-secret-remote.yaml | 37 +++++++------------
 ...ui-config-data-backup-secret-external.yaml | 37 +++++++------------
 ...t-qui-config-data-backup-secret-local.yaml | 37 +++++++------------
 ...-qui-config-data-backup-secret-remote.yaml | 37 +++++++------------
 ...nt-config-data-backup-source-external.yaml |  4 +-
 ...rrent-config-data-backup-source-local.yaml |  4 +-
 ...rent-config-data-backup-source-remote.yaml |  4 +-
 ...ge-config-data-backup-source-external.yaml |  4 +-
 ...anage-config-data-backup-source-local.yaml |  4 +-
 ...nage-config-data-backup-source-remote.yaml |  4 +-
 ...ui-config-data-backup-source-external.yaml |  4 +-
 ...t-qui-config-data-backup-source-local.yaml |  4 +-
 ...-qui-config-data-backup-source-remote.yaml |  4 +-
 ...darr-4k-config-backup-secret-external.yaml | 37 +++++++------------
 ...-radarr-4k-config-backup-secret-local.yaml | 37 +++++++------------
 ...radarr-4k-config-backup-secret-remote.yaml | 37 +++++++------------
 ...darr-4k-config-backup-source-external.yaml |  4 +-
 ...-radarr-4k-config-backup-source-local.yaml |  4 +-
 ...radarr-4k-config-backup-source-remote.yaml |  4 +-
 ...r-anime-config-backup-secret-external.yaml | 37 +++++++------------
 ...darr-anime-config-backup-secret-local.yaml | 37 +++++++------------
 ...arr-anime-config-backup-secret-remote.yaml | 37 +++++++------------
 ...r-anime-config-backup-source-external.yaml |  4 +-
 ...darr-anime-config-backup-source-local.yaml |  4 +-
 ...arr-anime-config-backup-source-remote.yaml |  4 +-
 ...standup-config-backup-secret-external.yaml | 37 +++++++------------
 ...rr-standup-config-backup-secret-local.yaml | 37 +++++++------------
 ...r-standup-config-backup-secret-remote.yaml | 37 +++++++------------
 ...standup-config-backup-source-external.yaml |  4 +-
 ...rr-standup-config-backup-source-local.yaml |  4 +-
 ...r-standup-config-backup-source-remote.yaml |  4 +-
 ...-radarr-config-backup-secret-external.yaml | 37 +++++++------------
 ...ret-radarr-config-backup-secret-local.yaml | 37 +++++++------------
 ...et-radarr-config-backup-secret-remote.yaml | 37 +++++++------------
 ...-radarr-config-backup-source-external.yaml |  4 +-
 ...rce-radarr-config-backup-source-local.yaml |  4 +-
 ...ce-radarr-config-backup-source-remote.yaml |  4 +-
 ...roundcube-data-backup-secret-external.yaml | 37 +++++++------------
 ...et-roundcube-data-backup-secret-local.yaml | 37 +++++++------------
 ...t-roundcube-data-backup-secret-remote.yaml | 37 +++++++------------
 ...roundcube-data-backup-source-external.yaml |  4 +-
 ...ce-roundcube-data-backup-source-local.yaml |  4 +-
 ...e-roundcube-data-backup-source-remote.yaml |  4 +-
 ...lickhouse-data-backup-secret-external.yaml | 37 +++++++------------
 ...t-clickhouse-data-backup-secret-local.yaml | 37 +++++++------------
 ...-clickhouse-data-backup-secret-remote.yaml | 37 +++++++------------
 ...lickhouse-data-backup-source-external.yaml |  4 +-
 ...e-clickhouse-data-backup-source-local.yaml |  4 +-
 ...-clickhouse-data-backup-source-remote.yaml |  4 +-
 ...g-browser-data-backup-secret-external.yaml | 37 +++++++------------
 ...rxng-browser-data-backup-secret-local.yaml | 37 +++++++------------
 ...xng-browser-data-backup-secret-remote.yaml | 37 +++++++------------
 ...g-browser-data-backup-source-external.yaml |  4 +-
 ...rxng-browser-data-backup-source-local.yaml |  4 +-
 ...xng-browser-data-backup-source-remote.yaml |  4 +-
 ...r-chart-config-backup-secret-external.yaml | 37 +++++++------------
 ...eerr-chart-config-backup-secret-local.yaml | 37 +++++++------------
 ...err-chart-config-backup-secret-remote.yaml | 37 +++++++------------
 ...r-chart-config-backup-source-external.yaml |  4 +-
 ...eerr-chart-config-backup-source-local.yaml |  4 +-
 ...err-chart-config-backup-source-remote.yaml |  4 +-
 ...cret-shelfmark-backup-secret-external.yaml | 37 +++++++------------
 ...lSecret-shelfmark-backup-secret-local.yaml | 37 +++++++------------
 ...Secret-shelfmark-backup-secret-remote.yaml | 37 +++++++------------
 ...urce-shelfmark-backup-source-external.yaml |  4 +-
 ...nSource-shelfmark-backup-source-local.yaml |  4 +-
 ...Source-shelfmark-backup-source-remote.yaml |  4 +-
 ...narr-4k-config-backup-secret-external.yaml | 37 +++++++------------
 ...-sonarr-4k-config-backup-secret-local.yaml | 37 +++++++------------
 ...sonarr-4k-config-backup-secret-remote.yaml | 37 +++++++------------
 ...narr-4k-config-backup-source-external.yaml |  4 +-
 ...-sonarr-4k-config-backup-source-local.yaml |  4 +-
 ...sonarr-4k-config-backup-source-remote.yaml |  4 +-
 ...r-anime-config-backup-secret-external.yaml | 37 +++++++------------
 ...narr-anime-config-backup-secret-local.yaml | 37 +++++++------------
 ...arr-anime-config-backup-secret-remote.yaml | 37 +++++++------------
 ...r-anime-config-backup-source-external.yaml |  4 +-
 ...narr-anime-config-backup-source-local.yaml |  4 +-
 ...arr-anime-config-backup-source-remote.yaml |  4 +-
 ...-sonarr-config-backup-secret-external.yaml | 37 +++++++------------
 ...ret-sonarr-config-backup-secret-local.yaml | 37 +++++++------------
 ...et-sonarr-config-backup-secret-remote.yaml | 37 +++++++------------
 ...-sonarr-config-backup-source-external.yaml |  4 +-
 ...rce-sonarr-config-backup-source-local.yaml |  4 +-
 ...ce-sonarr-config-backup-source-remote.yaml |  4 +-
 ...-server-backup-backup-secret-external.yaml | 37 +++++++------------
 ...ess-server-backup-backup-secret-local.yaml | 37 +++++++------------
 ...ss-server-backup-backup-secret-remote.yaml | 37 +++++++------------
 ...-server-backup-backup-source-external.yaml |  4 +-
 ...ess-server-backup-backup-source-local.yaml |  4 +-
 ...ss-server-backup-backup-source-remote.yaml |  4 +-
 ...talwart-config-backup-secret-external.yaml | 37 +++++++------------
 ...t-stalwart-config-backup-secret-local.yaml | 37 +++++++------------
 ...-stalwart-config-backup-secret-remote.yaml | 37 +++++++------------
 ...talwart-config-backup-source-external.yaml |  4 +-
 ...e-stalwart-config-backup-source-local.yaml |  4 +-
 ...-stalwart-config-backup-source-remote.yaml |  4 +-
 ...t-tdarr-config-backup-secret-external.yaml | 37 +++++++------------
 ...cret-tdarr-config-backup-secret-local.yaml | 37 +++++++------------
 ...ret-tdarr-config-backup-secret-remote.yaml | 37 +++++++------------
 ...t-tdarr-server-backup-secret-external.yaml | 37 +++++++------------
 ...cret-tdarr-server-backup-secret-local.yaml | 37 +++++++------------
 ...ret-tdarr-server-backup-secret-remote.yaml | 37 +++++++------------
 ...e-tdarr-config-backup-source-external.yaml |  4 +-
 ...urce-tdarr-config-backup-source-local.yaml |  4 +-
 ...rce-tdarr-config-backup-source-remote.yaml |  4 +-
 ...e-tdarr-server-backup-source-external.yaml |  4 +-
 ...urce-tdarr-server-backup-source-local.yaml |  4 +-
 ...rce-tdarr-server-backup-source-remote.yaml |  4 +-
 ...ultwarden-data-backup-secret-external.yaml | 37 +++++++------------
 ...-vaultwarden-data-backup-secret-local.yaml | 37 +++++++------------
 ...vaultwarden-data-backup-secret-remote.yaml | 37 +++++++------------
 ...ultwarden-data-backup-source-external.yaml |  4 +-
 ...-vaultwarden-data-backup-source-local.yaml |  4 +-
 ...vaultwarden-data-backup-source-remote.yaml |  4 +-
 ...alSecret-yubal-backup-secret-external.yaml | 37 +++++++------------
 ...ernalSecret-yubal-backup-secret-local.yaml | 37 +++++++------------
 ...rnalSecret-yubal-backup-secret-remote.yaml | 37 +++++++------------
 ...onSource-yubal-backup-source-external.yaml |  4 +-
 ...ationSource-yubal-backup-source-local.yaml |  4 +-
 ...tionSource-yubal-backup-source-remote.yaml |  4 +-
 344 files changed, 2580 insertions(+), 4472 deletions(-)

diff --git a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-external.yaml
index 009d1d90b..d6668acc5 100644
--- a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: backrest-config-backup-secret-external
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/backrest/backrest-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-local.yaml
index bca585bb7..36adbf54e 100644
--- a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: backrest-config-backup-secret-local
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/backrest/backrest-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-remote.yaml
index ca6998e0a..65416e117 100644
--- a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: backrest-config-backup-secret-remote
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/backrest/backrest-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-external.yaml
index cc8a47e74..e98f11faa 100644
--- a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: backrest-data-backup-secret-external
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/backrest/backrest-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-local.yaml
index 00b7fd1f0..c6acde4e7 100644
--- a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: backrest-data-backup-secret-local
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/backrest/backrest-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-remote.yaml
index b3de70eeb..28ae5484b 100644
--- a/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: backrest-data-backup-secret-remote
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/backrest/backrest-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-external.yaml b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-external.yaml
index 19b0f4663..8d605cec2 100644
--- a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: backrest-config-backup-source-external
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-local.yaml b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-local.yaml
index e7b08e02d..7d5a83145 100644
--- a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: backrest-config-backup-source-local
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-remote.yaml
index 720161f12..abd44d794 100644
--- a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: backrest-config-backup-source-remote
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-external.yaml b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-external.yaml
index 89b1e0128..962dff7dd 100644
--- a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: backrest-data-backup-source-external
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-local.yaml b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-local.yaml
index 2e6cf55bc..8324ff6d1 100644
--- a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: backrest-data-backup-source-local
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-remote.yaml
index ba937074d..5c495ed96 100644
--- a/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: backrest-data-backup-source-remote
   namespace: backrest
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: backrest
     app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: backrest-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-external.yaml
index 5b9125731..b8c32af66 100644
--- a/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: bazarr-config-backup-secret-external
   namespace: bazarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/part-of: bazarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/bazarr/bazarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/bazarr/bazarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-local.yaml
index e35fa7c0d..28b5a9ad2 100644
--- a/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: bazarr-config-backup-secret-local
   namespace: bazarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/part-of: bazarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/bazarr/bazarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/bazarr/bazarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-remote.yaml
index 97b8a92b5..bc3ffe9bf 100644
--- a/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/bazarr/ExternalSecret-bazarr-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: bazarr-config-backup-secret-remote
   namespace: bazarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/part-of: bazarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/bazarr/bazarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/bazarr/bazarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-external.yaml b/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-external.yaml
index ecc6c8e07..3f6e61799 100644
--- a/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: bazarr-config-backup-source-external
   namespace: bazarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/part-of: bazarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-local.yaml b/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-local.yaml
index 4989a9b1d..d1c61f9e9 100644
--- a/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: bazarr-config-backup-source-local
   namespace: bazarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/part-of: bazarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-remote.yaml
index 3a727c44c..727b4b23b 100644
--- a/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/bazarr/ReplicationSource-bazarr-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: bazarr-config-backup-source-remote
   namespace: bazarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: bazarr
     app.kubernetes.io/part-of: bazarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: bazarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-external.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-external.yaml
index 75648ac8b..d8031ad14 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-public-backup-secret-external
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-public-0.8.0
+    helm.sh/chart: volsync-target-public-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-public-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-public"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-public"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-local.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-local.yaml
index a3c4ca2d7..a53b33628 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-public-backup-secret-local
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-public-0.8.0
+    helm.sh/chart: volsync-target-public-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-public-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-public"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-public"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-remote.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-remote.yaml
index e2206e3ea..6c197628f 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-public-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-public-backup-secret-remote
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-public-0.8.0
+    helm.sh/chart: volsync-target-public-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-public-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-public"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-public"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-external.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-external.yaml
index b36da8e5f..c5fcfb565 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-storage-backup-secret-external
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-storage-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-storage"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-storage"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-local.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-local.yaml
index 6e5608390..47a085181 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-storage-backup-secret-local
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-storage-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-storage"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-storage"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-remote.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-remote.yaml
index a066cab2d..99afe0659 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-storage-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-storage-backup-secret-remote
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-storage-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-storage"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-storage"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-external.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-external.yaml
index 1fb997e12..7522b23ae 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-watched-backup-secret-external
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-watched-0.8.0
+    helm.sh/chart: volsync-target-watched-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-watched-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-watched"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-watched"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-local.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-local.yaml
index bd702ce1c..b861c147d 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-watched-backup-secret-local
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-watched-0.8.0
+    helm.sh/chart: volsync-target-watched-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-watched-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-watched"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-watched"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-remote.yaml b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-remote.yaml
index 0d06fafbc..8233f0854 100644
--- a/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ExternalSecret-dawarich-watched-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: dawarich-watched-backup-secret-remote
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-watched-0.8.0
+    helm.sh/chart: volsync-target-watched-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-watched-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/dawarich/dawarich-watched"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/dawarich/dawarich-watched"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-external.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-external.yaml
index 450f94c2e..d0e63c574 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-public-backup-source-external
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-public-0.8.0
+    helm.sh/chart: volsync-target-public-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-public-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-local.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-local.yaml
index a41507713..44455fefa 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-public-backup-source-local
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-public-0.8.0
+    helm.sh/chart: volsync-target-public-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-public-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-remote.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-remote.yaml
index 137f4e849..ef349d223 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-public-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-public-backup-source-remote
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-public-0.8.0
+    helm.sh/chart: volsync-target-public-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-public-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-external.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-external.yaml
index dad53d5f2..fa4e1fffe 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-storage-backup-source-external
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-storage-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-local.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-local.yaml
index 9e4dad56b..c13d2cbc6 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-storage-backup-source-local
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-storage-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-remote.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-remote.yaml
index 96b3a6e44..1ea90f6d4 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-storage-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-storage-backup-source-remote
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-storage-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-external.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-external.yaml
index 636eeb843..828bd4a39 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-watched-backup-source-external
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-watched-0.8.0
+    helm.sh/chart: volsync-target-watched-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-watched-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-local.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-local.yaml
index a437e46d6..53bc411b0 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-watched-backup-source-local
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-watched-0.8.0
+    helm.sh/chart: volsync-target-watched-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-watched-backup
 spec:
diff --git a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-remote.yaml b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-remote.yaml
index c8d9546ae..af2941deb 100644
--- a/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/dawarich/ReplicationSource-dawarich-watched-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: dawarich-watched-backup-source-remote
   namespace: dawarich
   labels:
-    helm.sh/chart: volsync-target-watched-0.8.0
+    helm.sh/chart: volsync-target-watched-1.0.0
     app.kubernetes.io/instance: dawarich
     app.kubernetes.io/part-of: dawarich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: dawarich-watched-backup
 spec:
diff --git a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-external.yaml b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-external.yaml
index e005e165d..b82668b2b 100644
--- a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: foldergram-db-backup-secret-external
   namespace: foldergram
   labels:
-    helm.sh/chart: volsync-target-db-0.8.0
+    helm.sh/chart: volsync-target-db-1.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-db-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/foldergram/foldergram-db"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/foldergram/foldergram-db"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-local.yaml b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-local.yaml
index 28ddca67b..bcacca9a0 100644
--- a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: foldergram-db-backup-secret-local
   namespace: foldergram
   labels:
-    helm.sh/chart: volsync-target-db-0.8.0
+    helm.sh/chart: volsync-target-db-1.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-db-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/foldergram/foldergram-db"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/foldergram/foldergram-db"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-remote.yaml b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-remote.yaml
index a0951d803..6b734b7d4 100644
--- a/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ExternalSecret-foldergram-db-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: foldergram-db-backup-secret-remote
   namespace: foldergram
   labels:
-    helm.sh/chart: volsync-target-db-0.8.0
+    helm.sh/chart: volsync-target-db-1.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-db-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/foldergram/foldergram-db"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/foldergram/foldergram-db"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-external.yaml b/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-external.yaml
index 9e0dadb89..ec1fef40f 100644
--- a/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: foldergram-db-backup-source-external
   namespace: foldergram
   labels:
-    helm.sh/chart: volsync-target-db-0.8.0
+    helm.sh/chart: volsync-target-db-1.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-db-backup
 spec:
diff --git a/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-local.yaml b/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-local.yaml
index 8b34e325b..80d947fd6 100644
--- a/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: foldergram-db-backup-source-local
   namespace: foldergram
   labels:
-    helm.sh/chart: volsync-target-db-0.8.0
+    helm.sh/chart: volsync-target-db-1.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-db-backup
 spec:
diff --git a/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-remote.yaml b/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-remote.yaml
index 0c2462090..54cc292c9 100644
--- a/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/foldergram/ReplicationSource-foldergram-db-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: foldergram-db-backup-source-remote
   namespace: foldergram
   labels:
-    helm.sh/chart: volsync-target-db-0.8.0
+    helm.sh/chart: volsync-target-db-1.0.0
     app.kubernetes.io/instance: foldergram
     app.kubernetes.io/part-of: foldergram
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: foldergram-db-backup
 spec:
diff --git a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-external.yaml
index 330aee40c..c9c4f209d 100644
--- a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: freshrss-data-backup-secret-external
   namespace: freshrss
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/freshrss/freshrss-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/freshrss/freshrss-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-local.yaml
index 3e71e1a83..aa381cbf3 100644
--- a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: freshrss-data-backup-secret-local
   namespace: freshrss
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/freshrss/freshrss-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/freshrss/freshrss-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-remote.yaml
index 9d5948700..07b31ae86 100644
--- a/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ExternalSecret-freshrss-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: freshrss-data-backup-secret-remote
   namespace: freshrss
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/freshrss/freshrss-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/freshrss/freshrss-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-external.yaml b/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-external.yaml
index af0915602..bd9048b2e 100644
--- a/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: freshrss-data-backup-source-external
   namespace: freshrss
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-local.yaml b/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-local.yaml
index f8d5aa5cf..13018ed53 100644
--- a/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: freshrss-data-backup-source-local
   namespace: freshrss
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-remote.yaml
index c24d51d44..23796578a 100644
--- a/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/freshrss/ReplicationSource-freshrss-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: freshrss-data-backup-source-remote
   namespace: freshrss
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: freshrss
     app.kubernetes.io/part-of: freshrss
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: freshrss-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-external.yaml b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-external.yaml
index 30634a961..94203ab50 100644
--- a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: gatus-backup-secret-external
   namespace: gatus
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gatus-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/gatus/gatus"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/gatus/gatus"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-local.yaml b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-local.yaml
index 09ed0a50d..ddb581b37 100644
--- a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: gatus-backup-secret-local
   namespace: gatus
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gatus-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/gatus/gatus"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/gatus/gatus"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-remote.yaml b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-remote.yaml
index 5a4ebe5a3..7529a26b7 100644
--- a/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/gatus/ExternalSecret-gatus-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: gatus-backup-secret-remote
   namespace: gatus
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gatus-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/gatus/gatus"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/gatus/gatus"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-external.yaml b/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-external.yaml
index 090323f90..bc49d150b 100644
--- a/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: gatus-backup-source-external
   namespace: gatus
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gatus-backup
 spec:
diff --git a/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-local.yaml b/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-local.yaml
index 61e2d83a9..7675088e1 100644
--- a/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: gatus-backup-source-local
   namespace: gatus
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gatus-backup
 spec:
diff --git a/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-remote.yaml b/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-remote.yaml
index 1ba3c523e..ce898f00a 100644
--- a/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/gatus/ReplicationSource-gatus-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: gatus-backup-source-remote
   namespace: gatus
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: gatus
     app.kubernetes.io/part-of: gatus
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gatus-backup
 spec:
diff --git a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-shared-storage-backup-secret-local.yaml b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-shared-storage-backup-secret-local.yaml
index 65328b02d..8c0453263 100644
--- a/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-shared-storage-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/gitea/ExternalSecret-gitea-shared-storage-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: gitea-shared-storage-backup-secret-local
   namespace: gitea
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/part-of: gitea
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gitea-shared-storage-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/gitea/gitea-shared-storage"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/gitea/gitea-shared-storage"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/gitea/ReplicationSource-gitea-shared-storage-backup-source-local.yaml b/clusters/cl01tl/manifests/gitea/ReplicationSource-gitea-shared-storage-backup-source-local.yaml
index 49370e273..e18c35b01 100644
--- a/clusters/cl01tl/manifests/gitea/ReplicationSource-gitea-shared-storage-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/gitea/ReplicationSource-gitea-shared-storage-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: gitea-shared-storage-backup-source-local
   namespace: gitea
   labels:
-    helm.sh/chart: volsync-target-storage-0.8.0
+    helm.sh/chart: volsync-target-storage-1.0.0
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/part-of: gitea
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: gitea-shared-storage-backup
 spec:
diff --git a/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-external.yaml
index c80244bfc..8c6f5dcc0 100644
--- a/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: grimmory-config-backup-secret-external
   namespace: grimmory
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/grimmory/grimmory-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/grimmory/grimmory-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-local.yaml
index 1527792f3..0b5099054 100644
--- a/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: grimmory-config-backup-secret-local
   namespace: grimmory
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/grimmory/grimmory-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/grimmory/grimmory-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-remote.yaml
index c0abf2367..5bf79ae6a 100644
--- a/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/grimmory/ExternalSecret-grimmory-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: grimmory-config-backup-secret-remote
   namespace: grimmory
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/grimmory/grimmory-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/grimmory/grimmory-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-external.yaml b/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-external.yaml
index 61d5ec112..1526adb75 100644
--- a/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: grimmory-config-backup-source-external
   namespace: grimmory
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-local.yaml b/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-local.yaml
index 6354b8e89..df2027e2a 100644
--- a/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: grimmory-config-backup-source-local
   namespace: grimmory
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-remote.yaml
index bb89aeadb..9f2d93d83 100644
--- a/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/grimmory/ReplicationSource-grimmory-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: grimmory-config-backup-source-remote
   namespace: grimmory
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: grimmory
     app.kubernetes.io/part-of: grimmory
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: grimmory-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-external.yaml
index 3002451ca..ad1733238 100644
--- a/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: home-assistant-config-backup-secret-external
   namespace: home-assistant
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: home-assistant-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/home-assistant/home-assistant-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/home-assistant/home-assistant-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-local.yaml
index 0219d213a..41bd94ab0 100644
--- a/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: home-assistant-config-backup-secret-local
   namespace: home-assistant
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: home-assistant-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/home-assistant/home-assistant-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/home-assistant/home-assistant-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-remote.yaml
index 0308640f0..168183195 100644
--- a/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/ExternalSecret-home-assistant-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: home-assistant-config-backup-secret-remote
   namespace: home-assistant
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: home-assistant-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/home-assistant/home-assistant-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/home-assistant/home-assistant-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-external.yaml b/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-external.yaml
index 17f34d1f5..1d9580f8e 100644
--- a/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: home-assistant-config-backup-source-external
   namespace: home-assistant
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: home-assistant-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-local.yaml b/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-local.yaml
index 9543bd2b7..7bbd31b21 100644
--- a/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: home-assistant-config-backup-source-local
   namespace: home-assistant
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: home-assistant-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-remote.yaml
index fdae2e2a8..e39950101 100644
--- a/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/home-assistant/ReplicationSource-home-assistant-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: home-assistant-config-backup-source-remote
   namespace: home-assistant
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: home-assistant
     app.kubernetes.io/part-of: home-assistant
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: home-assistant-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-external.yaml
index cf478e495..419214218 100644
--- a/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: houndarr-data-backup-secret-external
   namespace: houndarr
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: houndarr
     app.kubernetes.io/part-of: houndarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: houndarr-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/houndarr/houndarr-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/houndarr/houndarr-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-local.yaml
index bd82151ea..5540fde68 100644
--- a/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: houndarr-data-backup-secret-local
   namespace: houndarr
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: houndarr
     app.kubernetes.io/part-of: houndarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: houndarr-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/houndarr/houndarr-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/houndarr/houndarr-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-remote.yaml
index f48e0b5af..52cdbaf5b 100644
--- a/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/houndarr/ExternalSecret-houndarr-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: houndarr-data-backup-secret-remote
   namespace: houndarr
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: houndarr
     app.kubernetes.io/part-of: houndarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: houndarr-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/houndarr/houndarr-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/houndarr/houndarr-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-external.yaml b/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-external.yaml
index 360fa140e..73b4c781e 100644
--- a/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: houndarr-data-backup-source-external
   namespace: houndarr
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: houndarr
     app.kubernetes.io/part-of: houndarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: houndarr-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-local.yaml b/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-local.yaml
index 2eae03026..f00a64fdf 100644
--- a/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: houndarr-data-backup-source-local
   namespace: houndarr
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: houndarr
     app.kubernetes.io/part-of: houndarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: houndarr-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-remote.yaml
index 3f9259603..08a512d45 100644
--- a/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/houndarr/ReplicationSource-houndarr-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: houndarr-data-backup-source-remote
   namespace: houndarr
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: houndarr
     app.kubernetes.io/part-of: houndarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: houndarr-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-external.yaml b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-external.yaml
index 8e31cf1b0..bb79f8492 100644
--- a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: immich-backup-secret-external
   namespace: immich
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: immich
     app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: immich-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/immich/immich"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/immich/immich"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-local.yaml b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-local.yaml
index 67da9ba7d..c30d92981 100644
--- a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: immich-backup-secret-local
   namespace: immich
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: immich
     app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: immich-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/immich/immich"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/immich/immich"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-remote.yaml b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-remote.yaml
index 623475099..80e7b5307 100644
--- a/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/immich/ExternalSecret-immich-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: immich-backup-secret-remote
   namespace: immich
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: immich
     app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: immich-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/immich/immich"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/immich/immich"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-external.yaml b/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-external.yaml
index ac58ce7da..f70d481dc 100644
--- a/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: immich-backup-source-external
   namespace: immich
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: immich
     app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: immich-backup
 spec:
diff --git a/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-local.yaml b/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-local.yaml
index 53989c78b..b49255a3b 100644
--- a/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: immich-backup-source-local
   namespace: immich
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: immich
     app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: immich-backup
 spec:
diff --git a/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-remote.yaml b/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-remote.yaml
index 78b9d1d48..8f5031e21 100644
--- a/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/immich/ReplicationSource-immich-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: immich-backup-source-remote
   namespace: immich
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: immich
     app.kubernetes.io/part-of: immich
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: immich-backup
 spec:
diff --git a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-external.yaml
index 1cfb6a019..b9b3c36ce 100644
--- a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: jellyfin-config-backup-secret-external
   namespace: jellyfin
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellyfin-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/jellyfin/jellyfin-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/jellyfin/jellyfin-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-local.yaml
index fd47e3840..7616f41b2 100644
--- a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: jellyfin-config-backup-secret-local
   namespace: jellyfin
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellyfin-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/jellyfin/jellyfin-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/jellyfin/jellyfin-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-remote.yaml
index b4d142ac2..e4e08c21e 100644
--- a/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ExternalSecret-jellyfin-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: jellyfin-config-backup-secret-remote
   namespace: jellyfin
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellyfin-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/jellyfin/jellyfin-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/jellyfin/jellyfin-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-external.yaml b/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-external.yaml
index 21497fb03..d1d89588f 100644
--- a/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: jellyfin-config-backup-source-external
   namespace: jellyfin
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellyfin-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-local.yaml b/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-local.yaml
index 31407ff89..b47c902c6 100644
--- a/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: jellyfin-config-backup-source-local
   namespace: jellyfin
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellyfin-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-remote.yaml
index 1d2d5a501..1c416d770 100644
--- a/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/jellyfin/ReplicationSource-jellyfin-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: jellyfin-config-backup-source-remote
   namespace: jellyfin
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: jellyfin
     app.kubernetes.io/part-of: jellyfin
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellyfin-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-external.yaml
index 7a9d50432..aa6f0cd23 100644
--- a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: jellystat-data-backup-secret-external
   namespace: jellystat
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellystat-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/jellystat/jellystat-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/jellystat/jellystat-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-local.yaml
index 81697c742..01a4d1b1f 100644
--- a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: jellystat-data-backup-secret-local
   namespace: jellystat
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellystat-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/jellystat/jellystat-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/jellystat/jellystat-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-remote.yaml
index 118d0de1f..0004f9f54 100644
--- a/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ExternalSecret-jellystat-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: jellystat-data-backup-secret-remote
   namespace: jellystat
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellystat-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/jellystat/jellystat-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/jellystat/jellystat-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-external.yaml b/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-external.yaml
index f454ce3b8..eae9b8cb0 100644
--- a/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: jellystat-data-backup-source-external
   namespace: jellystat
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellystat-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-local.yaml b/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-local.yaml
index 66a18105a..603914e14 100644
--- a/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: jellystat-data-backup-source-local
   namespace: jellystat
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellystat-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-remote.yaml
index c821fb142..d6bc6278e 100644
--- a/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/jellystat/ReplicationSource-jellystat-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: jellystat-data-backup-source-remote
   namespace: jellystat
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: jellystat
     app.kubernetes.io/part-of: jellystat
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: jellystat-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-external.yaml b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-external.yaml
index 7fd3221b6..7bbf083f2 100644
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: karakeep-backup-secret-external
   namespace: karakeep
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/karakeep/karakeep"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/karakeep/karakeep"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-local.yaml b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-local.yaml
index 7b599e906..dc22cfabd 100644
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: karakeep-backup-secret-local
   namespace: karakeep
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/karakeep/karakeep"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/karakeep/karakeep"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-remote.yaml b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-remote.yaml
index de097fd2d..8be81cac0 100644
--- a/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ExternalSecret-karakeep-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: karakeep-backup-secret-remote
   namespace: karakeep
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/karakeep/karakeep"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/karakeep/karakeep"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-external.yaml b/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-external.yaml
index 710cd4206..4c0ffece9 100644
--- a/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: karakeep-backup-source-external
   namespace: karakeep
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-backup
 spec:
diff --git a/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-local.yaml b/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-local.yaml
index f34fbe513..ce66c2c8a 100644
--- a/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: karakeep-backup-source-local
   namespace: karakeep
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-backup
 spec:
diff --git a/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-remote.yaml b/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-remote.yaml
index f225468dc..bc34731f7 100644
--- a/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/karakeep/ReplicationSource-karakeep-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: karakeep-backup-source-remote
   namespace: karakeep
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: karakeep
     app.kubernetes.io/part-of: karakeep
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: karakeep-backup
 spec:
diff --git a/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-external.yaml b/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-external.yaml
index f8ed8357f..ccee8d894 100644
--- a/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: komodo-keys-backup-secret-external
   namespace: komodo
   labels:
-    helm.sh/chart: volsync-target-keys-0.8.0
+    helm.sh/chart: volsync-target-keys-1.0.0
     app.kubernetes.io/instance: komodo
     app.kubernetes.io/part-of: komodo
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: komodo-keys-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/komodo/komodo-keys"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/komodo/komodo-keys"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-local.yaml b/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-local.yaml
index da0603a9d..bd85f9e75 100644
--- a/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: komodo-keys-backup-secret-local
   namespace: komodo
   labels:
-    helm.sh/chart: volsync-target-keys-0.8.0
+    helm.sh/chart: volsync-target-keys-1.0.0
     app.kubernetes.io/instance: komodo
     app.kubernetes.io/part-of: komodo
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: komodo-keys-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/komodo/komodo-keys"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/komodo/komodo-keys"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-remote.yaml b/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-remote.yaml
index ad31c10c2..3a338b44d 100644
--- a/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/komodo/ExternalSecret-komodo-keys-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: komodo-keys-backup-secret-remote
   namespace: komodo
   labels:
-    helm.sh/chart: volsync-target-keys-0.8.0
+    helm.sh/chart: volsync-target-keys-1.0.0
     app.kubernetes.io/instance: komodo
     app.kubernetes.io/part-of: komodo
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: komodo-keys-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/komodo/komodo-keys"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/komodo/komodo-keys"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-external.yaml b/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-external.yaml
index 7fed77200..e6fde6ddb 100644
--- a/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: komodo-keys-backup-source-external
   namespace: komodo
   labels:
-    helm.sh/chart: volsync-target-keys-0.8.0
+    helm.sh/chart: volsync-target-keys-1.0.0
     app.kubernetes.io/instance: komodo
     app.kubernetes.io/part-of: komodo
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: komodo-keys-backup
 spec:
diff --git a/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-local.yaml b/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-local.yaml
index a77a7f02d..6f9f041e0 100644
--- a/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: komodo-keys-backup-source-local
   namespace: komodo
   labels:
-    helm.sh/chart: volsync-target-keys-0.8.0
+    helm.sh/chart: volsync-target-keys-1.0.0
     app.kubernetes.io/instance: komodo
     app.kubernetes.io/part-of: komodo
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: komodo-keys-backup
 spec:
diff --git a/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-remote.yaml b/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-remote.yaml
index 64dc9417a..646fa2e16 100644
--- a/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/komodo/ReplicationSource-komodo-keys-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: komodo-keys-backup-source-remote
   namespace: komodo
   labels:
-    helm.sh/chart: volsync-target-keys-0.8.0
+    helm.sh/chart: volsync-target-keys-1.0.0
     app.kubernetes.io/instance: komodo
     app.kubernetes.io/part-of: komodo
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: komodo-keys-backup
 spec:
diff --git a/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-external.yaml
index ad9979167..b4aa29bfa 100644
--- a/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: languagetool-data-backup-secret-external
   namespace: languagetool
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: languagetool
     app.kubernetes.io/part-of: languagetool
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: languagetool-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/languagetool/languagetool-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/languagetool/languagetool-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-local.yaml
index 90da0a546..bf606592d 100644
--- a/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: languagetool-data-backup-secret-local
   namespace: languagetool
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: languagetool
     app.kubernetes.io/part-of: languagetool
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: languagetool-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/languagetool/languagetool-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/languagetool/languagetool-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-remote.yaml
index fac67d7ab..f248ebf93 100644
--- a/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/languagetool/ExternalSecret-languagetool-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: languagetool-data-backup-secret-remote
   namespace: languagetool
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: languagetool
     app.kubernetes.io/part-of: languagetool
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: languagetool-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/languagetool/languagetool-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/languagetool/languagetool-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-external.yaml b/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-external.yaml
index feadbc63a..47c6e7bee 100644
--- a/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: languagetool-data-backup-source-external
   namespace: languagetool
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: languagetool
     app.kubernetes.io/part-of: languagetool
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: languagetool-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-local.yaml b/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-local.yaml
index 88795ecb8..092f0294e 100644
--- a/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: languagetool-data-backup-source-local
   namespace: languagetool
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: languagetool
     app.kubernetes.io/part-of: languagetool
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: languagetool-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-remote.yaml
index c9fb30e5c..7f88746e3 100644
--- a/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/languagetool/ReplicationSource-languagetool-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: languagetool-data-backup-source-remote
   namespace: languagetool
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: languagetool
     app.kubernetes.io/part-of: languagetool
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: languagetool-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-external.yaml b/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-external.yaml
index 3b8eca1ea..fc5107e69 100644
--- a/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: libation-backup-secret-external
   namespace: libation
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: libation
     app.kubernetes.io/part-of: libation
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: libation-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/libation/libation"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/libation/libation"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-local.yaml b/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-local.yaml
index 122ec63c4..8b39d7e4e 100644
--- a/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: libation-backup-secret-local
   namespace: libation
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: libation
     app.kubernetes.io/part-of: libation
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: libation-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/libation/libation"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/libation/libation"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-remote.yaml b/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-remote.yaml
index 535436d59..a62ff652e 100644
--- a/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/libation/ExternalSecret-libation-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: libation-backup-secret-remote
   namespace: libation
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: libation
     app.kubernetes.io/part-of: libation
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: libation-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/libation/libation"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/libation/libation"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-external.yaml b/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-external.yaml
index 35f7db1cb..6950cbebc 100644
--- a/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: libation-backup-source-external
   namespace: libation
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: libation
     app.kubernetes.io/part-of: libation
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: libation-backup
 spec:
diff --git a/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-local.yaml b/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-local.yaml
index a82671288..6350fb9ec 100644
--- a/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: libation-backup-source-local
   namespace: libation
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: libation
     app.kubernetes.io/part-of: libation
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: libation-backup
 spec:
diff --git a/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-remote.yaml b/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-remote.yaml
index f5070a59d..e654b15aa 100644
--- a/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/libation/ReplicationSource-libation-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: libation-backup-source-remote
   namespace: libation
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: libation
     app.kubernetes.io/part-of: libation
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: libation-backup
 spec:
diff --git a/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-external.yaml
index 9379e6e4b..c2fe628a9 100644
--- a/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: lidarr-config-backup-secret-external
   namespace: lidarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: lidarr
     app.kubernetes.io/part-of: lidarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: lidarr-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/lidarr/lidarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/lidarr/lidarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-local.yaml
index 2db020d58..39efd2895 100644
--- a/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: lidarr-config-backup-secret-local
   namespace: lidarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: lidarr
     app.kubernetes.io/part-of: lidarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: lidarr-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/lidarr/lidarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/lidarr/lidarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-remote.yaml
index 879ac38db..98718133e 100644
--- a/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/lidarr/ExternalSecret-lidarr-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: lidarr-config-backup-secret-remote
   namespace: lidarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: lidarr
     app.kubernetes.io/part-of: lidarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: lidarr-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/lidarr/lidarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/lidarr/lidarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-external.yaml b/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-external.yaml
index 3886605b0..e614e12f0 100644
--- a/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: lidarr-config-backup-source-external
   namespace: lidarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: lidarr
     app.kubernetes.io/part-of: lidarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: lidarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-local.yaml b/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-local.yaml
index 6e5225136..c2db4e3ad 100644
--- a/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: lidarr-config-backup-source-local
   namespace: lidarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: lidarr
     app.kubernetes.io/part-of: lidarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: lidarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-remote.yaml
index 6f051506b..979de29c2 100644
--- a/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/lidarr/ReplicationSource-lidarr-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: lidarr-config-backup-source-remote
   namespace: lidarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: lidarr
     app.kubernetes.io/part-of: lidarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: lidarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-external.yaml
index 23300f678..e37493b91 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: matrix-hookshot-backup-secret-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-hookshot-0.8.0
+    helm.sh/chart: volsync-target-hookshot-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-hookshot-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/matrix-hookshot"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/matrix-hookshot"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-local.yaml
index b50f678c5..9cd78ea4a 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: matrix-hookshot-backup-secret-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-hookshot-0.8.0
+    helm.sh/chart: volsync-target-hookshot-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-hookshot-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/matrix-hookshot"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/matrix-hookshot"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-remote.yaml
index cf769df99..3358a7eef 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-hookshot-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: matrix-hookshot-backup-secret-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-hookshot-0.8.0
+    helm.sh/chart: volsync-target-hookshot-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-hookshot-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/matrix-hookshot"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/matrix-hookshot"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-external.yaml
index 175f6a4e2..3767ed477 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: matrix-synapse-backup-secret-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-synapse-0.8.0
+    helm.sh/chart: volsync-target-synapse-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/matrix-synapse"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/matrix-synapse"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-local.yaml
index 22c03d43e..a0a748999 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: matrix-synapse-backup-secret-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-synapse-0.8.0
+    helm.sh/chart: volsync-target-synapse-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/matrix-synapse"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/matrix-synapse"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-remote.yaml
index 403a7d002..08df05dd2 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-matrix-synapse-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: matrix-synapse-backup-secret-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-synapse-0.8.0
+    helm.sh/chart: volsync-target-synapse-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/matrix-synapse"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/matrix-synapse"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-external.yaml
index 61adb6439..f3252d777 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: mautrix-discord-backup-secret-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-discord-0.8.0
+    helm.sh/chart: volsync-target-discord-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-discord-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/mautrix-discord"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/mautrix-discord"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-local.yaml
index 57512823d..ff3e1ccba 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: mautrix-discord-backup-secret-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-discord-0.8.0
+    helm.sh/chart: volsync-target-discord-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-discord-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/mautrix-discord"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/mautrix-discord"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-remote.yaml
index 9899a17e5..74ea26487 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-discord-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: mautrix-discord-backup-secret-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-discord-0.8.0
+    helm.sh/chart: volsync-target-discord-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-discord-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/mautrix-discord"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/mautrix-discord"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-external.yaml
index a8a9db96e..291f2aef8 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: mautrix-whatsapp-backup-secret-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-whatsapp-0.8.0
+    helm.sh/chart: volsync-target-whatsapp-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-whatsapp-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/mautrix-whatsapp"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/mautrix-whatsapp"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-local.yaml
index c00ac512f..763e06dc9 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: mautrix-whatsapp-backup-secret-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-whatsapp-0.8.0
+    helm.sh/chart: volsync-target-whatsapp-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-whatsapp-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/mautrix-whatsapp"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/mautrix-whatsapp"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-remote.yaml
index e4a217c1e..2998f5df2 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ExternalSecret-mautrix-whatsapp-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: mautrix-whatsapp-backup-secret-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-whatsapp-0.8.0
+    helm.sh/chart: volsync-target-whatsapp-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-whatsapp-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/matrix-synapse/mautrix-whatsapp"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/matrix-synapse/mautrix-whatsapp"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-external.yaml
index 9da9503c1..cd99cb4b7 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: matrix-hookshot-backup-source-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-hookshot-0.8.0
+    helm.sh/chart: volsync-target-hookshot-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-hookshot-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-local.yaml
index d36e68e60..ab71d0499 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: matrix-hookshot-backup-source-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-hookshot-0.8.0
+    helm.sh/chart: volsync-target-hookshot-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-hookshot-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-remote.yaml
index 3aa3d0062..dd8c5ee17 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-hookshot-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: matrix-hookshot-backup-source-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-hookshot-0.8.0
+    helm.sh/chart: volsync-target-hookshot-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-hookshot-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-external.yaml
index 7d249a73d..a027987bc 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-backup-source-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-synapse-0.8.0
+    helm.sh/chart: volsync-target-synapse-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-local.yaml
index 8544f73e9..7af1924fb 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-backup-source-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-synapse-0.8.0
+    helm.sh/chart: volsync-target-synapse-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-remote.yaml
index 73124a4da..04f6386ed 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-matrix-synapse-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: matrix-synapse-backup-source-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-synapse-0.8.0
+    helm.sh/chart: volsync-target-synapse-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: matrix-synapse-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-external.yaml
index 77f12aba5..ec70407ef 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: mautrix-discord-backup-source-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-discord-0.8.0
+    helm.sh/chart: volsync-target-discord-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-discord-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-local.yaml
index eedd27ded..e7b52ed47 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: mautrix-discord-backup-source-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-discord-0.8.0
+    helm.sh/chart: volsync-target-discord-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-discord-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-remote.yaml
index 3dc1d06e4..d09475df2 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-discord-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: mautrix-discord-backup-source-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-discord-0.8.0
+    helm.sh/chart: volsync-target-discord-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-discord-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-external.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-external.yaml
index 25e420611..a5adf8e16 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: mautrix-whatsapp-backup-source-external
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-whatsapp-0.8.0
+    helm.sh/chart: volsync-target-whatsapp-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-whatsapp-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-local.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-local.yaml
index 6258f311a..a3b9ec4d8 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: mautrix-whatsapp-backup-source-local
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-whatsapp-0.8.0
+    helm.sh/chart: volsync-target-whatsapp-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-whatsapp-backup
 spec:
diff --git a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-remote.yaml b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-remote.yaml
index 490aaa1b5..6af98f2c6 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/ReplicationSource-mautrix-whatsapp-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: mautrix-whatsapp-backup-source-remote
   namespace: matrix-synapse
   labels:
-    helm.sh/chart: volsync-target-whatsapp-0.8.0
+    helm.sh/chart: volsync-target-whatsapp-1.0.0
     app.kubernetes.io/instance: matrix-synapse
     app.kubernetes.io/part-of: matrix-synapse
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mautrix-whatsapp-backup
 spec:
diff --git a/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-external.yaml
index a287b52ca..39f723788 100644
--- a/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: medialyze-data-backup-secret-external
   namespace: medialyze
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: medialyze
     app.kubernetes.io/part-of: medialyze
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: medialyze-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/medialyze/medialyze-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/medialyze/medialyze-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-local.yaml
index cd37c004a..2546b4e3c 100644
--- a/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: medialyze-data-backup-secret-local
   namespace: medialyze
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: medialyze
     app.kubernetes.io/part-of: medialyze
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: medialyze-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/medialyze/medialyze-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/medialyze/medialyze-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-remote.yaml
index ab86056a2..ccab124e9 100644
--- a/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/medialyze/ExternalSecret-medialyze-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: medialyze-data-backup-secret-remote
   namespace: medialyze
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: medialyze
     app.kubernetes.io/part-of: medialyze
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: medialyze-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/medialyze/medialyze-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/medialyze/medialyze-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-external.yaml b/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-external.yaml
index 9e08bc827..4019ca664 100644
--- a/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: medialyze-data-backup-source-external
   namespace: medialyze
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: medialyze
     app.kubernetes.io/part-of: medialyze
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: medialyze-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-local.yaml b/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-local.yaml
index e331b0ce2..45b8941ee 100644
--- a/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: medialyze-data-backup-source-local
   namespace: medialyze
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: medialyze
     app.kubernetes.io/part-of: medialyze
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: medialyze-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-remote.yaml
index 15bd5f6dc..841ebad3b 100644
--- a/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/medialyze/ReplicationSource-medialyze-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: medialyze-data-backup-source-remote
   namespace: medialyze
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: medialyze
     app.kubernetes.io/part-of: medialyze
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: medialyze-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-external.yaml
index 48457768a..3ef1e9ebe 100644
--- a/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: music-grabber-data-backup-secret-external
   namespace: music-grabber
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: music-grabber
     app.kubernetes.io/part-of: music-grabber
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: music-grabber-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/music-grabber/music-grabber-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/music-grabber/music-grabber-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-local.yaml
index 797e02c6e..a9563fcfb 100644
--- a/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: music-grabber-data-backup-secret-local
   namespace: music-grabber
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: music-grabber
     app.kubernetes.io/part-of: music-grabber
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: music-grabber-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/music-grabber/music-grabber-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/music-grabber/music-grabber-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-remote.yaml
index d2fc83b5f..ff5ba0f52 100644
--- a/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/music-grabber/ExternalSecret-music-grabber-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: music-grabber-data-backup-secret-remote
   namespace: music-grabber
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: music-grabber
     app.kubernetes.io/part-of: music-grabber
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: music-grabber-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/music-grabber/music-grabber-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/music-grabber/music-grabber-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-external.yaml b/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-external.yaml
index 974383b41..92e5ca63c 100644
--- a/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: music-grabber-data-backup-source-external
   namespace: music-grabber
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: music-grabber
     app.kubernetes.io/part-of: music-grabber
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: music-grabber-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-local.yaml b/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-local.yaml
index 77f9d76e8..1b83d451a 100644
--- a/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: music-grabber-data-backup-source-local
   namespace: music-grabber
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: music-grabber
     app.kubernetes.io/part-of: music-grabber
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: music-grabber-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-remote.yaml
index 483af14c2..1f1f63fc1 100644
--- a/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/music-grabber/ReplicationSource-music-grabber-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: music-grabber-data-backup-source-remote
   namespace: music-grabber
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: music-grabber
     app.kubernetes.io/part-of: music-grabber
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: music-grabber-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-external.yaml
index c6f095ff0..39b8bcc54 100644
--- a/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: navidrome-data-backup-secret-external
   namespace: navidrome
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: navidrome
     app.kubernetes.io/part-of: navidrome
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: navidrome-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/navidrome/navidrome-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/navidrome/navidrome-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-local.yaml
index 8d92b41ef..3768c80c9 100644
--- a/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: navidrome-data-backup-secret-local
   namespace: navidrome
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: navidrome
     app.kubernetes.io/part-of: navidrome
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: navidrome-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/navidrome/navidrome-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/navidrome/navidrome-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-remote.yaml
index 6f78a3f37..0fc9975ac 100644
--- a/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/navidrome/ExternalSecret-navidrome-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: navidrome-data-backup-secret-remote
   namespace: navidrome
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: navidrome
     app.kubernetes.io/part-of: navidrome
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: navidrome-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/navidrome/navidrome-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/navidrome/navidrome-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-external.yaml b/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-external.yaml
index ebe93a133..ebd93ca04 100644
--- a/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: navidrome-data-backup-source-external
   namespace: navidrome
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: navidrome
     app.kubernetes.io/part-of: navidrome
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: navidrome-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-local.yaml b/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-local.yaml
index 0cbb72360..b886bfee2 100644
--- a/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: navidrome-data-backup-source-local
   namespace: navidrome
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: navidrome
     app.kubernetes.io/part-of: navidrome
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: navidrome-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-remote.yaml
index ba55193c5..199d377fd 100644
--- a/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/navidrome/ReplicationSource-navidrome-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: navidrome-data-backup-source-remote
   namespace: navidrome
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: navidrome
     app.kubernetes.io/part-of: navidrome
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: navidrome-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-external.yaml
index fe83050b0..e0a62a842 100644
--- a/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: ollama-web-data-backup-secret-external
   namespace: ollama
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: ollama
     app.kubernetes.io/part-of: ollama
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: ollama-web-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/ollama/ollama-web-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/ollama/ollama-web-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-local.yaml
index 4759bd33f..f4db2ef07 100644
--- a/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: ollama-web-data-backup-secret-local
   namespace: ollama
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: ollama
     app.kubernetes.io/part-of: ollama
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: ollama-web-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/ollama/ollama-web-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/ollama/ollama-web-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-remote.yaml
index 5613ccea9..7016514c8 100644
--- a/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/ollama/ExternalSecret-ollama-web-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: ollama-web-data-backup-secret-remote
   namespace: ollama
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: ollama
     app.kubernetes.io/part-of: ollama
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: ollama-web-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/ollama/ollama-web-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/ollama/ollama-web-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-external.yaml b/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-external.yaml
index 9855df39e..7635ea330 100644
--- a/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: ollama-web-data-backup-source-external
   namespace: ollama
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: ollama
     app.kubernetes.io/part-of: ollama
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: ollama-web-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-local.yaml b/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-local.yaml
index 786120502..190747366 100644
--- a/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: ollama-web-data-backup-source-local
   namespace: ollama
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: ollama
     app.kubernetes.io/part-of: ollama
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: ollama-web-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-remote.yaml
index 20376887e..744501654 100644
--- a/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/ollama/ReplicationSource-ollama-web-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: ollama-web-data-backup-source-remote
   namespace: ollama
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: ollama
     app.kubernetes.io/part-of: ollama
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: ollama-web-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-external.yaml
index 439cc2470..a6d40658d 100644
--- a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: outline-data-backup-secret-external
   namespace: outline
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/outline/outline-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/outline/outline-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-local.yaml
index 26a8a30c5..84ff866e5 100644
--- a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: outline-data-backup-secret-local
   namespace: outline
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/outline/outline-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/outline/outline-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-remote.yaml
index 7a9571a27..8622cf14c 100644
--- a/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/outline/ExternalSecret-outline-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: outline-data-backup-secret-remote
   namespace: outline
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/outline/outline-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/outline/outline-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-external.yaml b/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-external.yaml
index b7e7ee518..c432acf2e 100644
--- a/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: outline-data-backup-source-external
   namespace: outline
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-local.yaml b/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-local.yaml
index f16a3168b..adbf2bb51 100644
--- a/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: outline-data-backup-source-local
   namespace: outline
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-remote.yaml
index 820073a3a..357a7d1c7 100644
--- a/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/outline/ReplicationSource-outline-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: outline-data-backup-source-remote
   namespace: outline
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: outline
     app.kubernetes.io/part-of: outline
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: outline-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-external.yaml
index 29ba80d3d..cf751d86e 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-consume-backup-secret-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-consume-0.8.0
+    helm.sh/chart: volsync-target-consume-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-consume-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-consume"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-consume"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-local.yaml
index e9e961442..9c3d49a23 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-consume-backup-secret-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-consume-0.8.0
+    helm.sh/chart: volsync-target-consume-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-consume-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-consume"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-consume"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-remote.yaml
index b6af01aaf..871e4a3b9 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-consume-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-consume-backup-secret-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-consume-0.8.0
+    helm.sh/chart: volsync-target-consume-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-consume-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-consume"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-consume"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-external.yaml
index efef5840a..6dad352bc 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-data-backup-secret-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-local.yaml
index 5f532c064..51b761d0e 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-data-backup-secret-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-remote.yaml
index 8757e15f6..4ea397956 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-data-backup-secret-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-external.yaml
index 30a21ebf8..12f6687b1 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-export-backup-secret-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-export-0.8.0
+    helm.sh/chart: volsync-target-export-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-export-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-export"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-export"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-local.yaml
index 807220472..45cb0030f 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-export-backup-secret-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-export-0.8.0
+    helm.sh/chart: volsync-target-export-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-export-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-export"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-export"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-remote.yaml
index 8b03b0c88..0d3c339bc 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-export-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-export-backup-secret-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-export-0.8.0
+    helm.sh/chart: volsync-target-export-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-export-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-export"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-export"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-external.yaml
index 358d3387b..9d620b01c 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-media-backup-secret-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-media-0.8.0
+    helm.sh/chart: volsync-target-media-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-media-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-media"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-media"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-local.yaml
index d92d396f5..54dc37425 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-media-backup-secret-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-media-0.8.0
+    helm.sh/chart: volsync-target-media-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-media-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-media"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-media"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-remote.yaml
index 488174c4a..89c472e38 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ExternalSecret-paperless-ngx-media-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: paperless-ngx-media-backup-secret-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-media-0.8.0
+    helm.sh/chart: volsync-target-media-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-media-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/paperless-ngx/paperless-ngx-media"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/paperless-ngx/paperless-ngx-media"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-external.yaml
index dd6902c15..f31323bf6 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-consume-backup-source-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-consume-0.8.0
+    helm.sh/chart: volsync-target-consume-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-consume-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-local.yaml
index bbe3cf09c..6b59f3441 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-consume-backup-source-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-consume-0.8.0
+    helm.sh/chart: volsync-target-consume-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-consume-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-remote.yaml
index 45b603e3e..8e6e17132 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-consume-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-consume-backup-source-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-consume-0.8.0
+    helm.sh/chart: volsync-target-consume-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-consume-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-external.yaml
index 55ac4df25..dd8d28aa3 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-data-backup-source-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-local.yaml
index 122bd7d55..92b73a3a2 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-data-backup-source-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-remote.yaml
index 140d824d4..df82ea2da 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-data-backup-source-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-external.yaml
index 389afd679..c1ff79593 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-export-backup-source-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-export-0.8.0
+    helm.sh/chart: volsync-target-export-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-export-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-local.yaml
index 2ec762df5..c44886c37 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-export-backup-source-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-export-0.8.0
+    helm.sh/chart: volsync-target-export-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-export-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-remote.yaml
index 77d5f81bb..253870eab 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-export-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-export-backup-source-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-export-0.8.0
+    helm.sh/chart: volsync-target-export-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-export-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-external.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-external.yaml
index edab966d4..b3b36781d 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-media-backup-source-external
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-media-0.8.0
+    helm.sh/chart: volsync-target-media-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-media-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-local.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-local.yaml
index d60fc4a73..55b03480f 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-media-backup-source-local
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-media-0.8.0
+    helm.sh/chart: volsync-target-media-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-media-backup
 spec:
diff --git a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-remote.yaml b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-remote.yaml
index 9618d5aa1..f3467df14 100644
--- a/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/paperless-ngx/ReplicationSource-paperless-ngx-media-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: paperless-ngx-media-backup-source-remote
   namespace: paperless-ngx
   labels:
-    helm.sh/chart: volsync-target-media-0.8.0
+    helm.sh/chart: volsync-target-media-1.0.0
     app.kubernetes.io/instance: paperless-ngx
     app.kubernetes.io/part-of: paperless-ngx
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: paperless-ngx-media-backup
 spec:
diff --git a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-external.yaml
index 827705d1f..2487d789d 100644
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: postiz-config-backup-secret-external
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/postiz/postiz-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-local.yaml
index 20832c043..acf7415dc 100644
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: postiz-config-backup-secret-local
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/postiz/postiz-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-remote.yaml
index 1935e23cc..55435a0c9 100644
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: postiz-config-backup-secret-remote
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/postiz/postiz-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-external.yaml b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-external.yaml
index 48f449832..37197e858 100644
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: postiz-uploads-backup-secret-external
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-upload-0.8.0
+    helm.sh/chart: volsync-target-upload-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-uploads-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-uploads"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/postiz/postiz-uploads"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-local.yaml b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-local.yaml
index 0ac392db9..069279e02 100644
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: postiz-uploads-backup-secret-local
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-upload-0.8.0
+    helm.sh/chart: volsync-target-upload-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-uploads-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-uploads"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/postiz/postiz-uploads"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-remote.yaml b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-remote.yaml
index b51f2ef85..28fdd1035 100644
--- a/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/postiz/ExternalSecret-postiz-uploads-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: postiz-uploads-backup-secret-remote
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-upload-0.8.0
+    helm.sh/chart: volsync-target-upload-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-uploads-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-uploads"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/postiz/postiz-uploads"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-external.yaml b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-external.yaml
index 9d1f9be5a..75fdf5c5e 100644
--- a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: postiz-config-backup-source-external
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-local.yaml b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-local.yaml
index ddffcc101..b7ad871d3 100644
--- a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: postiz-config-backup-source-local
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-remote.yaml
index d0f92096f..b689daeab 100644
--- a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: postiz-config-backup-source-remote
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-external.yaml b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-external.yaml
index 9b3c1d10b..e5c784a2d 100644
--- a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: postiz-uploads-backup-source-external
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-upload-0.8.0
+    helm.sh/chart: volsync-target-upload-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-uploads-backup
 spec:
diff --git a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-local.yaml b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-local.yaml
index eccd7f559..0fc01bd51 100644
--- a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: postiz-uploads-backup-source-local
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-upload-0.8.0
+    helm.sh/chart: volsync-target-upload-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-uploads-backup
 spec:
diff --git a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-remote.yaml b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-remote.yaml
index 334635e7a..2bc9d54a6 100644
--- a/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/postiz/ReplicationSource-postiz-uploads-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: postiz-uploads-backup-source-remote
   namespace: postiz
   labels:
-    helm.sh/chart: volsync-target-upload-0.8.0
+    helm.sh/chart: volsync-target-upload-1.0.0
     app.kubernetes.io/instance: postiz
     app.kubernetes.io/part-of: postiz
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postiz-uploads-backup
 spec:
diff --git a/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-external.yaml
index 591341ec0..9c6a55cd2 100644
--- a/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: prowlarr-config-backup-secret-external
   namespace: prowlarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: prowlarr
     app.kubernetes.io/part-of: prowlarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: prowlarr-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/prowlarr/prowlarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/prowlarr/prowlarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-local.yaml
index b860c1971..d2cbc8cc8 100644
--- a/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: prowlarr-config-backup-secret-local
   namespace: prowlarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: prowlarr
     app.kubernetes.io/part-of: prowlarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: prowlarr-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/prowlarr/prowlarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/prowlarr/prowlarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-remote.yaml
index 6c71f7d22..84e48d9f1 100644
--- a/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/prowlarr/ExternalSecret-prowlarr-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: prowlarr-config-backup-secret-remote
   namespace: prowlarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: prowlarr
     app.kubernetes.io/part-of: prowlarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: prowlarr-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/prowlarr/prowlarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/prowlarr/prowlarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-external.yaml b/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-external.yaml
index ff20b4279..1c04a964d 100644
--- a/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: prowlarr-config-backup-source-external
   namespace: prowlarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: prowlarr
     app.kubernetes.io/part-of: prowlarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: prowlarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-local.yaml b/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-local.yaml
index 610f9e627..4f39d1a03 100644
--- a/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: prowlarr-config-backup-source-local
   namespace: prowlarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: prowlarr
     app.kubernetes.io/part-of: prowlarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: prowlarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-remote.yaml
index c77c7cb31..fdf9e0f6b 100644
--- a/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/prowlarr/ReplicationSource-prowlarr-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: prowlarr-config-backup-source-remote
   namespace: prowlarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: prowlarr
     app.kubernetes.io/part-of: prowlarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: prowlarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-external.yaml
index 6fe02a7a6..1b4c5528d 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-config-data-backup-secret-external
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-config-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-local.yaml
index 8c29d3160..8ab393d55 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-config-data-backup-secret-local
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-config-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-remote.yaml
index 5770a2a2f..46d7560b1 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-config-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-config-data-backup-secret-remote
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-config-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-external.yaml
index 9de2c9e78..49de92d7c 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-qbit-manage-config-data-backup-secret-external
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qbit-manage-config-0.8.0
+    helm.sh/chart: volsync-target-qbit-manage-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qbit-manage-config-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-qbit-manage-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-qbit-manage-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-local.yaml
index d07ecbe17..98c69ea61 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-qbit-manage-config-data-backup-secret-local
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qbit-manage-config-0.8.0
+    helm.sh/chart: volsync-target-qbit-manage-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qbit-manage-config-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-qbit-manage-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-qbit-manage-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-remote.yaml
index 5592c312b..d5949f872 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qbit-manage-config-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-qbit-manage-config-data-backup-secret-remote
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qbit-manage-config-0.8.0
+    helm.sh/chart: volsync-target-qbit-manage-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qbit-manage-config-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-qbit-manage-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-qbit-manage-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-external.yaml
index 68cbbd820..22577c823 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-qui-config-data-backup-secret-external
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qui-config-0.8.0
+    helm.sh/chart: volsync-target-qui-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qui-config-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-qui-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-qui-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-local.yaml
index ea40ae8e3..e1daa8c15 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-qui-config-data-backup-secret-local
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qui-config-0.8.0
+    helm.sh/chart: volsync-target-qui-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qui-config-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-qui-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-qui-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-remote.yaml
index 3a215a80e..52cfe9e5d 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ExternalSecret-qbittorrent-qui-config-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: qbittorrent-qui-config-data-backup-secret-remote
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qui-config-0.8.0
+    helm.sh/chart: volsync-target-qui-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qui-config-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/qbittorrent/qbittorrent-qui-config-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/qbittorrent/qbittorrent-qui-config-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-external.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-external.yaml
index 47fd210fa..b4a4af24b 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-config-data-backup-source-external
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-local.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-local.yaml
index a5b7ae5c7..0ab7b8a86 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-config-data-backup-source-local
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-remote.yaml
index 4817e405d..3a969fd92 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-config-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-config-data-backup-source-remote
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-external.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-external.yaml
index 76dd2da44..17835a645 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-qbit-manage-config-data-backup-source-external
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qbit-manage-config-0.8.0
+    helm.sh/chart: volsync-target-qbit-manage-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qbit-manage-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-local.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-local.yaml
index f0842953c..65c898c50 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-qbit-manage-config-data-backup-source-local
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qbit-manage-config-0.8.0
+    helm.sh/chart: volsync-target-qbit-manage-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qbit-manage-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-remote.yaml
index 0ba7884b9..7ad9c50a4 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qbit-manage-config-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-qbit-manage-config-data-backup-source-remote
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qbit-manage-config-0.8.0
+    helm.sh/chart: volsync-target-qbit-manage-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qbit-manage-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-external.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-external.yaml
index dfd20622a..61f4a0c87 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-qui-config-data-backup-source-external
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qui-config-0.8.0
+    helm.sh/chart: volsync-target-qui-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qui-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-local.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-local.yaml
index cbd861f37..dfeffca08 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-qui-config-data-backup-source-local
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qui-config-0.8.0
+    helm.sh/chart: volsync-target-qui-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qui-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-remote.yaml
index 7121d9ba5..22c5596e2 100644
--- a/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/qbittorrent/ReplicationSource-qbittorrent-qui-config-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: qbittorrent-qui-config-data-backup-source-remote
   namespace: qbittorrent
   labels:
-    helm.sh/chart: volsync-target-qui-config-0.8.0
+    helm.sh/chart: volsync-target-qui-config-1.0.0
     app.kubernetes.io/instance: qbittorrent
     app.kubernetes.io/part-of: qbittorrent
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: qbittorrent-qui-config-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-external.yaml
index 70236a734..ffb29e748 100644
--- a/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-4k-config-backup-secret-external
   namespace: radarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-4k
     app.kubernetes.io/part-of: radarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-4k-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-4k/radarr-4k-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-4k/radarr-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-local.yaml
index 0740807eb..787af9752 100644
--- a/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-4k-config-backup-secret-local
   namespace: radarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-4k
     app.kubernetes.io/part-of: radarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-4k-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-4k/radarr-4k-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-4k/radarr-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-remote.yaml
index 72b47065a..411c4440a 100644
--- a/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr-4k/ExternalSecret-radarr-4k-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-4k-config-backup-secret-remote
   namespace: radarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-4k
     app.kubernetes.io/part-of: radarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-4k-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-4k/radarr-4k-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-4k/radarr-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-external.yaml b/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-external.yaml
index 67a106184..7a1ba55d9 100644
--- a/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-4k-config-backup-source-external
   namespace: radarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-4k
     app.kubernetes.io/part-of: radarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-4k-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-local.yaml b/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-local.yaml
index 4f3f4e403..21a9f1ea2 100644
--- a/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-4k-config-backup-source-local
   namespace: radarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-4k
     app.kubernetes.io/part-of: radarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-4k-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-remote.yaml
index 466bebd29..549078cfd 100644
--- a/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr-4k/ReplicationSource-radarr-4k-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-4k-config-backup-source-remote
   namespace: radarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-4k
     app.kubernetes.io/part-of: radarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-4k-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-external.yaml
index e7f0c6757..abfede167 100644
--- a/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-anime-config-backup-secret-external
   namespace: radarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-anime
     app.kubernetes.io/part-of: radarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-anime-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-anime/radarr-anime-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-anime/radarr-anime-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-local.yaml
index ba17c9676..1588ce53f 100644
--- a/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-anime-config-backup-secret-local
   namespace: radarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-anime
     app.kubernetes.io/part-of: radarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-anime-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-anime/radarr-anime-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-anime/radarr-anime-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-remote.yaml
index 83adb9189..f09ce51de 100644
--- a/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr-anime/ExternalSecret-radarr-anime-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-anime-config-backup-secret-remote
   namespace: radarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-anime
     app.kubernetes.io/part-of: radarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-anime-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-anime/radarr-anime-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-anime/radarr-anime-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-external.yaml b/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-external.yaml
index e885e7b7c..cde0c3e16 100644
--- a/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-anime-config-backup-source-external
   namespace: radarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-anime
     app.kubernetes.io/part-of: radarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-anime-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-local.yaml b/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-local.yaml
index 9506aef33..7f55bdfde 100644
--- a/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-anime-config-backup-source-local
   namespace: radarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-anime
     app.kubernetes.io/part-of: radarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-anime-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-remote.yaml
index 5de81a004..f85da48d0 100644
--- a/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr-anime/ReplicationSource-radarr-anime-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-anime-config-backup-source-remote
   namespace: radarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-anime
     app.kubernetes.io/part-of: radarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-anime-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-external.yaml
index da2a67529..59ad64316 100644
--- a/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-standup-config-backup-secret-external
   namespace: radarr-standup
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-standup
     app.kubernetes.io/part-of: radarr-standup
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-standup-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-standup/radarr-standup-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-standup/radarr-standup-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-local.yaml
index 8c6aeaaf0..1a329b2e4 100644
--- a/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-standup-config-backup-secret-local
   namespace: radarr-standup
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-standup
     app.kubernetes.io/part-of: radarr-standup
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-standup-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-standup/radarr-standup-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-standup/radarr-standup-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-remote.yaml
index e47ad62fb..fcb7f59fa 100644
--- a/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr-standup/ExternalSecret-radarr-standup-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-standup-config-backup-secret-remote
   namespace: radarr-standup
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-standup
     app.kubernetes.io/part-of: radarr-standup
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-standup-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr-standup/radarr-standup-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr-standup/radarr-standup-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-external.yaml b/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-external.yaml
index c480c9a59..01e4fbc70 100644
--- a/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-standup-config-backup-source-external
   namespace: radarr-standup
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-standup
     app.kubernetes.io/part-of: radarr-standup
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-standup-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-local.yaml b/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-local.yaml
index b94155b9a..ba9c9233f 100644
--- a/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-standup-config-backup-source-local
   namespace: radarr-standup
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-standup
     app.kubernetes.io/part-of: radarr-standup
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-standup-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-remote.yaml
index 9f59048ab..73ab9abeb 100644
--- a/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr-standup/ReplicationSource-radarr-standup-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-standup-config-backup-source-remote
   namespace: radarr-standup
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr-standup
     app.kubernetes.io/part-of: radarr-standup
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-standup-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-external.yaml
index 3516713e5..0cf867244 100644
--- a/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-config-backup-secret-external
   namespace: radarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr
     app.kubernetes.io/part-of: radarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr/radarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr/radarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-local.yaml
index f99c305a6..ed74c3008 100644
--- a/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-config-backup-secret-local
   namespace: radarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr
     app.kubernetes.io/part-of: radarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr/radarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr/radarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-remote.yaml
index d1e6a92f4..1cf8e20f5 100644
--- a/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr/ExternalSecret-radarr-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: radarr-config-backup-secret-remote
   namespace: radarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr
     app.kubernetes.io/part-of: radarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/radarr/radarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/radarr/radarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-external.yaml b/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-external.yaml
index 50a543f31..84f4adb34 100644
--- a/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-config-backup-source-external
   namespace: radarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr
     app.kubernetes.io/part-of: radarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-local.yaml b/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-local.yaml
index 407410ff8..82544f723 100644
--- a/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-config-backup-source-local
   namespace: radarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr
     app.kubernetes.io/part-of: radarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-remote.yaml
index e82985e08..c6b486411 100644
--- a/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/radarr/ReplicationSource-radarr-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: radarr-config-backup-source-remote
   namespace: radarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: radarr
     app.kubernetes.io/part-of: radarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: radarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-external.yaml
index ddbb0c0a5..970678e98 100644
--- a/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: roundcube-data-backup-secret-external
   namespace: roundcube
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: roundcube
     app.kubernetes.io/part-of: roundcube
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: roundcube-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/roundcube/roundcube-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/roundcube/roundcube-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-local.yaml
index 86669a84d..b5bd4a6bf 100644
--- a/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: roundcube-data-backup-secret-local
   namespace: roundcube
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: roundcube
     app.kubernetes.io/part-of: roundcube
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: roundcube-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/roundcube/roundcube-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/roundcube/roundcube-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-remote.yaml
index 29c596bc1..2e58e4b21 100644
--- a/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/roundcube/ExternalSecret-roundcube-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: roundcube-data-backup-secret-remote
   namespace: roundcube
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: roundcube
     app.kubernetes.io/part-of: roundcube
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: roundcube-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/roundcube/roundcube-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/roundcube/roundcube-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-external.yaml b/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-external.yaml
index 909c07fa8..a3c2964fb 100644
--- a/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: roundcube-data-backup-source-external
   namespace: roundcube
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: roundcube
     app.kubernetes.io/part-of: roundcube
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: roundcube-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-local.yaml b/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-local.yaml
index b691d3ea4..49a7a16ca 100644
--- a/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: roundcube-data-backup-source-local
   namespace: roundcube
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: roundcube
     app.kubernetes.io/part-of: roundcube
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: roundcube-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-remote.yaml
index b8e0a83a1..0675714b0 100644
--- a/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/roundcube/ReplicationSource-roundcube-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: roundcube-data-backup-source-remote
   namespace: roundcube
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: roundcube
     app.kubernetes.io/part-of: roundcube
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: roundcube-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-external.yaml
index b2ceb794d..dcb1f08b7 100644
--- a/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: clickhouse-data-backup-secret-external
   namespace: rybbit
   labels:
-    helm.sh/chart: volsync-target-clickhouse-data-0.8.0
+    helm.sh/chart: volsync-target-clickhouse-data-1.0.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: clickhouse-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/rybbit/clickhouse-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/rybbit/clickhouse-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-local.yaml
index bf8faa2d0..3081058f9 100644
--- a/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: clickhouse-data-backup-secret-local
   namespace: rybbit
   labels:
-    helm.sh/chart: volsync-target-clickhouse-data-0.8.0
+    helm.sh/chart: volsync-target-clickhouse-data-1.0.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: clickhouse-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/rybbit/clickhouse-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/rybbit/clickhouse-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-remote.yaml
index 7eb7a0431..eed2d6af3 100644
--- a/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ExternalSecret-clickhouse-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: clickhouse-data-backup-secret-remote
   namespace: rybbit
   labels:
-    helm.sh/chart: volsync-target-clickhouse-data-0.8.0
+    helm.sh/chart: volsync-target-clickhouse-data-1.0.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: clickhouse-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/rybbit/clickhouse-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/rybbit/clickhouse-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-external.yaml b/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-external.yaml
index 35ff98537..d2d231042 100644
--- a/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: clickhouse-data-backup-source-external
   namespace: rybbit
   labels:
-    helm.sh/chart: volsync-target-clickhouse-data-0.8.0
+    helm.sh/chart: volsync-target-clickhouse-data-1.0.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: clickhouse-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-local.yaml b/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-local.yaml
index cc5d8290d..6413f1314 100644
--- a/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: clickhouse-data-backup-source-local
   namespace: rybbit
   labels:
-    helm.sh/chart: volsync-target-clickhouse-data-0.8.0
+    helm.sh/chart: volsync-target-clickhouse-data-1.0.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: clickhouse-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-remote.yaml
index ca1ec8911..86a365a9f 100644
--- a/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/rybbit/ReplicationSource-clickhouse-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: clickhouse-data-backup-source-remote
   namespace: rybbit
   labels:
-    helm.sh/chart: volsync-target-clickhouse-data-0.8.0
+    helm.sh/chart: volsync-target-clickhouse-data-1.0.0
     app.kubernetes.io/instance: rybbit
     app.kubernetes.io/part-of: rybbit
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: clickhouse-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-external.yaml
index 14884abc4..7f5a11092 100644
--- a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: searxng-browser-data-backup-secret-external
   namespace: searxng
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: searxng
     app.kubernetes.io/part-of: searxng
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: searxng-browser-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/searxng/searxng-browser-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/searxng/searxng-browser-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-local.yaml
index e75bfaf1f..2f3256547 100644
--- a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: searxng-browser-data-backup-secret-local
   namespace: searxng
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: searxng
     app.kubernetes.io/part-of: searxng
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: searxng-browser-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/searxng/searxng-browser-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/searxng/searxng-browser-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-remote.yaml
index 8a4435798..4eca7cef9 100644
--- a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: searxng-browser-data-backup-secret-remote
   namespace: searxng
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: searxng
     app.kubernetes.io/part-of: searxng
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: searxng-browser-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/searxng/searxng-browser-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/searxng/searxng-browser-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-external.yaml b/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-external.yaml
index 5f241b1d5..0210a8c11 100644
--- a/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: searxng-browser-data-backup-source-external
   namespace: searxng
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: searxng
     app.kubernetes.io/part-of: searxng
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: searxng-browser-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-local.yaml b/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-local.yaml
index f82bfe30c..0a2a13f72 100644
--- a/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: searxng-browser-data-backup-source-local
   namespace: searxng
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: searxng
     app.kubernetes.io/part-of: searxng
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: searxng-browser-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-remote.yaml
index 3c1860549..a99e17a26 100644
--- a/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/searxng/ReplicationSource-searxng-browser-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: searxng-browser-data-backup-source-remote
   namespace: searxng
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: searxng
     app.kubernetes.io/part-of: searxng
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: searxng-browser-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-external.yaml
index bfb9c2135..29aed20aa 100644
--- a/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: seerr-seerr-chart-config-backup-secret-external
   namespace: seerr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: seerr
     app.kubernetes.io/part-of: seerr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: seerr-seerr-chart-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/seerr/seerr-seerr-chart-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/seerr/seerr-seerr-chart-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-local.yaml
index ef9615f2c..3dd432090 100644
--- a/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: seerr-seerr-chart-config-backup-secret-local
   namespace: seerr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: seerr
     app.kubernetes.io/part-of: seerr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: seerr-seerr-chart-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/seerr/seerr-seerr-chart-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/seerr/seerr-seerr-chart-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-remote.yaml
index 6df5d7bc5..9967948bf 100644
--- a/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/seerr/ExternalSecret-seerr-seerr-chart-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: seerr-seerr-chart-config-backup-secret-remote
   namespace: seerr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: seerr
     app.kubernetes.io/part-of: seerr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: seerr-seerr-chart-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/seerr/seerr-seerr-chart-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/seerr/seerr-seerr-chart-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-external.yaml b/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-external.yaml
index 3c42dbdb8..2fe0c5f9c 100644
--- a/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: seerr-seerr-chart-config-backup-source-external
   namespace: seerr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: seerr
     app.kubernetes.io/part-of: seerr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: seerr-seerr-chart-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-local.yaml b/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-local.yaml
index dedf642f6..525b9ae28 100644
--- a/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: seerr-seerr-chart-config-backup-source-local
   namespace: seerr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: seerr
     app.kubernetes.io/part-of: seerr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: seerr-seerr-chart-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-remote.yaml
index f16b0175d..4fdc8965b 100644
--- a/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/seerr/ReplicationSource-seerr-seerr-chart-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: seerr-seerr-chart-config-backup-source-remote
   namespace: seerr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: seerr
     app.kubernetes.io/part-of: seerr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: seerr-seerr-chart-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-external.yaml b/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-external.yaml
index 39ef0581e..b13f45d13 100644
--- a/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: shelfmark-backup-secret-external
   namespace: shelfmark
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: shelfmark
     app.kubernetes.io/part-of: shelfmark
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: shelfmark-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/shelfmark/shelfmark"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/shelfmark/shelfmark"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-local.yaml b/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-local.yaml
index c23c3c726..a999c60de 100644
--- a/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: shelfmark-backup-secret-local
   namespace: shelfmark
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: shelfmark
     app.kubernetes.io/part-of: shelfmark
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: shelfmark-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/shelfmark/shelfmark"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/shelfmark/shelfmark"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-remote.yaml b/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-remote.yaml
index 3ab3dadf2..76aa2468f 100644
--- a/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/shelfmark/ExternalSecret-shelfmark-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: shelfmark-backup-secret-remote
   namespace: shelfmark
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: shelfmark
     app.kubernetes.io/part-of: shelfmark
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: shelfmark-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/shelfmark/shelfmark"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/shelfmark/shelfmark"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-external.yaml b/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-external.yaml
index d44ddb729..40549ae5d 100644
--- a/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: shelfmark-backup-source-external
   namespace: shelfmark
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: shelfmark
     app.kubernetes.io/part-of: shelfmark
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: shelfmark-backup
 spec:
diff --git a/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-local.yaml b/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-local.yaml
index c6653f2ec..64494476d 100644
--- a/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: shelfmark-backup-source-local
   namespace: shelfmark
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: shelfmark
     app.kubernetes.io/part-of: shelfmark
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: shelfmark-backup
 spec:
diff --git a/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-remote.yaml b/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-remote.yaml
index dcaf034b9..2d4a48c75 100644
--- a/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/shelfmark/ReplicationSource-shelfmark-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: shelfmark-backup-source-remote
   namespace: shelfmark
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: shelfmark
     app.kubernetes.io/part-of: shelfmark
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: shelfmark-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-external.yaml
index be1074eb6..e66b4f33e 100644
--- a/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-4k-config-backup-secret-external
   namespace: sonarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-4k
     app.kubernetes.io/part-of: sonarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-4k-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr-4k/sonarr-4k-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr-4k/sonarr-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-local.yaml
index b69491b2d..6cb5bf687 100644
--- a/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-4k-config-backup-secret-local
   namespace: sonarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-4k
     app.kubernetes.io/part-of: sonarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-4k-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr-4k/sonarr-4k-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr-4k/sonarr-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-remote.yaml
index c0068f6c7..a8940ea52 100644
--- a/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/sonarr-4k/ExternalSecret-sonarr-4k-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-4k-config-backup-secret-remote
   namespace: sonarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-4k
     app.kubernetes.io/part-of: sonarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-4k-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr-4k/sonarr-4k-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr-4k/sonarr-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-external.yaml b/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-external.yaml
index a96b178c3..2891cc1c8 100644
--- a/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-4k-config-backup-source-external
   namespace: sonarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-4k
     app.kubernetes.io/part-of: sonarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-4k-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-local.yaml b/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-local.yaml
index f9cdb303e..786ea1fd3 100644
--- a/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-4k-config-backup-source-local
   namespace: sonarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-4k
     app.kubernetes.io/part-of: sonarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-4k-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-remote.yaml
index 311e68ce0..767cc25a2 100644
--- a/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/sonarr-4k/ReplicationSource-sonarr-4k-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-4k-config-backup-source-remote
   namespace: sonarr-4k
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-4k
     app.kubernetes.io/part-of: sonarr-4k
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-4k-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-external.yaml
index 78b423f12..179815431 100644
--- a/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-anime-config-backup-secret-external
   namespace: sonarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-anime
     app.kubernetes.io/part-of: sonarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-anime-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr-anime/sonarr-anime-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr-anime/sonarr-anime-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-local.yaml
index 68b1db86a..452be8245 100644
--- a/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-anime-config-backup-secret-local
   namespace: sonarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-anime
     app.kubernetes.io/part-of: sonarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-anime-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr-anime/sonarr-anime-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr-anime/sonarr-anime-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-remote.yaml
index 30a20348c..f78d76c44 100644
--- a/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/sonarr-anime/ExternalSecret-sonarr-anime-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-anime-config-backup-secret-remote
   namespace: sonarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-anime
     app.kubernetes.io/part-of: sonarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-anime-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr-anime/sonarr-anime-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr-anime/sonarr-anime-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-external.yaml b/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-external.yaml
index f271e430d..5da5ffbf9 100644
--- a/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-anime-config-backup-source-external
   namespace: sonarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-anime
     app.kubernetes.io/part-of: sonarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-anime-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-local.yaml b/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-local.yaml
index 728e2beb6..db2f64a07 100644
--- a/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-anime-config-backup-source-local
   namespace: sonarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-anime
     app.kubernetes.io/part-of: sonarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-anime-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-remote.yaml
index f65ac3b70..c01937806 100644
--- a/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/sonarr-anime/ReplicationSource-sonarr-anime-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-anime-config-backup-source-remote
   namespace: sonarr-anime
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr-anime
     app.kubernetes.io/part-of: sonarr-anime
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-anime-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-external.yaml
index 8bf0f4c8f..8d27df349 100644
--- a/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-config-backup-secret-external
   namespace: sonarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr
     app.kubernetes.io/part-of: sonarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr/sonarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr/sonarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-local.yaml
index cd26a145c..f8d175d7e 100644
--- a/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-config-backup-secret-local
   namespace: sonarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr
     app.kubernetes.io/part-of: sonarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr/sonarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr/sonarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-remote.yaml
index db9e56a46..b62d652bd 100644
--- a/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/sonarr/ExternalSecret-sonarr-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sonarr-config-backup-secret-remote
   namespace: sonarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr
     app.kubernetes.io/part-of: sonarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sonarr/sonarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sonarr/sonarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-external.yaml b/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-external.yaml
index 0d9d7d0d3..246e668a8 100644
--- a/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-config-backup-source-external
   namespace: sonarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr
     app.kubernetes.io/part-of: sonarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-local.yaml b/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-local.yaml
index bdf73ee40..dd91edcf5 100644
--- a/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-config-backup-source-local
   namespace: sonarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr
     app.kubernetes.io/part-of: sonarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-remote.yaml
index f328ebd2a..362242701 100644
--- a/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/sonarr/ReplicationSource-sonarr-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sonarr-config-backup-source-remote
   namespace: sonarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: sonarr
     app.kubernetes.io/part-of: sonarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sonarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-external.yaml b/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-external.yaml
index 05bc43888..7afdf9312 100644
--- a/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sparkyfitness-server-backup-backup-secret-external
   namespace: sparkyfitness
   labels:
-    helm.sh/chart: volsync-target-backup-0.8.0
+    helm.sh/chart: volsync-target-backup-1.0.0
     app.kubernetes.io/instance: sparkyfitness
     app.kubernetes.io/part-of: sparkyfitness
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sparkyfitness-server-backup-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sparkyfitness/sparkyfitness-server-backup"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sparkyfitness/sparkyfitness-server-backup"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-local.yaml b/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-local.yaml
index 3d333ee4a..5337da92c 100644
--- a/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sparkyfitness-server-backup-backup-secret-local
   namespace: sparkyfitness
   labels:
-    helm.sh/chart: volsync-target-backup-0.8.0
+    helm.sh/chart: volsync-target-backup-1.0.0
     app.kubernetes.io/instance: sparkyfitness
     app.kubernetes.io/part-of: sparkyfitness
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sparkyfitness-server-backup-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sparkyfitness/sparkyfitness-server-backup"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sparkyfitness/sparkyfitness-server-backup"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-remote.yaml b/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-remote.yaml
index 1eb997e90..21d74ac94 100644
--- a/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/sparkyfitness/ExternalSecret-sparkyfitness-server-backup-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: sparkyfitness-server-backup-backup-secret-remote
   namespace: sparkyfitness
   labels:
-    helm.sh/chart: volsync-target-backup-0.8.0
+    helm.sh/chart: volsync-target-backup-1.0.0
     app.kubernetes.io/instance: sparkyfitness
     app.kubernetes.io/part-of: sparkyfitness
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sparkyfitness-server-backup-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/sparkyfitness/sparkyfitness-server-backup"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/sparkyfitness/sparkyfitness-server-backup"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-external.yaml b/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-external.yaml
index fbb6eb1b0..8bfefae49 100644
--- a/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sparkyfitness-server-backup-backup-source-external
   namespace: sparkyfitness
   labels:
-    helm.sh/chart: volsync-target-backup-0.8.0
+    helm.sh/chart: volsync-target-backup-1.0.0
     app.kubernetes.io/instance: sparkyfitness
     app.kubernetes.io/part-of: sparkyfitness
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sparkyfitness-server-backup-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-local.yaml b/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-local.yaml
index 9e68e3660..6e8840a1d 100644
--- a/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sparkyfitness-server-backup-backup-source-local
   namespace: sparkyfitness
   labels:
-    helm.sh/chart: volsync-target-backup-0.8.0
+    helm.sh/chart: volsync-target-backup-1.0.0
     app.kubernetes.io/instance: sparkyfitness
     app.kubernetes.io/part-of: sparkyfitness
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sparkyfitness-server-backup-backup
 spec:
diff --git a/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-remote.yaml b/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-remote.yaml
index e29c8e126..c5adf2b53 100644
--- a/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/sparkyfitness/ReplicationSource-sparkyfitness-server-backup-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: sparkyfitness-server-backup-backup-source-remote
   namespace: sparkyfitness
   labels:
-    helm.sh/chart: volsync-target-backup-0.8.0
+    helm.sh/chart: volsync-target-backup-1.0.0
     app.kubernetes.io/instance: sparkyfitness
     app.kubernetes.io/part-of: sparkyfitness
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: sparkyfitness-server-backup-backup
 spec:
diff --git a/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-external.yaml
index 587eb2ccc..b4b4ebcf8 100644
--- a/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: stalwart-config-backup-secret-external
   namespace: stalwart
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: stalwart
     app.kubernetes.io/part-of: stalwart
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: stalwart-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/stalwart/stalwart-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/stalwart/stalwart-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-local.yaml
index c9bc3c505..5204ddd44 100644
--- a/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: stalwart-config-backup-secret-local
   namespace: stalwart
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: stalwart
     app.kubernetes.io/part-of: stalwart
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: stalwart-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/stalwart/stalwart-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/stalwart/stalwart-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-remote.yaml
index eed9a86ad..51be0dacb 100644
--- a/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/stalwart/ExternalSecret-stalwart-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: stalwart-config-backup-secret-remote
   namespace: stalwart
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: stalwart
     app.kubernetes.io/part-of: stalwart
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: stalwart-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/stalwart/stalwart-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/stalwart/stalwart-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-external.yaml b/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-external.yaml
index 43f09451b..9672acb50 100644
--- a/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: stalwart-config-backup-source-external
   namespace: stalwart
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: stalwart
     app.kubernetes.io/part-of: stalwart
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: stalwart-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-local.yaml b/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-local.yaml
index f08ba10df..53b189757 100644
--- a/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: stalwart-config-backup-source-local
   namespace: stalwart
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: stalwart
     app.kubernetes.io/part-of: stalwart
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: stalwart-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-remote.yaml
index 1e96faca7..1ecfcf905 100644
--- a/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/stalwart/ReplicationSource-stalwart-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: stalwart-config-backup-source-remote
   namespace: stalwart
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: stalwart
     app.kubernetes.io/part-of: stalwart
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: stalwart-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-external.yaml b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-external.yaml
index 2ba211b6d..a253315d8 100644
--- a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: tdarr-config-backup-secret-external
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-config-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/tdarr/tdarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/tdarr/tdarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-local.yaml b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-local.yaml
index c706a146e..78871ab0f 100644
--- a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: tdarr-config-backup-secret-local
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-config-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/tdarr/tdarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/tdarr/tdarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-remote.yaml b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-remote.yaml
index b92b45214..2c004c623 100644
--- a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-config-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: tdarr-config-backup-secret-remote
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-config-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/tdarr/tdarr-config"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/tdarr/tdarr-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-external.yaml b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-external.yaml
index edad36552..67c115127 100644
--- a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: tdarr-server-backup-secret-external
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-server-0.8.0
+    helm.sh/chart: volsync-target-server-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-server-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/tdarr/tdarr-server"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/tdarr/tdarr-server"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-local.yaml b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-local.yaml
index ea5e3efda..99ce9cb9c 100644
--- a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: tdarr-server-backup-secret-local
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-server-0.8.0
+    helm.sh/chart: volsync-target-server-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-server-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/tdarr/tdarr-server"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/tdarr/tdarr-server"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-remote.yaml b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-remote.yaml
index 91e125823..c22c66a00 100644
--- a/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ExternalSecret-tdarr-server-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: tdarr-server-backup-secret-remote
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-server-0.8.0
+    helm.sh/chart: volsync-target-server-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-server-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/tdarr/tdarr-server"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/tdarr/tdarr-server"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-external.yaml b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-external.yaml
index ccde60c46..3709ec645 100644
--- a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: tdarr-config-backup-source-external
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-local.yaml b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-local.yaml
index 42592dcf9..2e45e02ac 100644
--- a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: tdarr-config-backup-source-local
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-remote.yaml b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-remote.yaml
index 5e794639d..e29fbddf5 100644
--- a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-config-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: tdarr-config-backup-source-remote
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-config-backup
 spec:
diff --git a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-external.yaml b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-external.yaml
index 9ef32bf96..fd2449be9 100644
--- a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: tdarr-server-backup-source-external
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-server-0.8.0
+    helm.sh/chart: volsync-target-server-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-server-backup
 spec:
diff --git a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-local.yaml b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-local.yaml
index 4def7a5b0..586ab4295 100644
--- a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: tdarr-server-backup-source-local
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-server-0.8.0
+    helm.sh/chart: volsync-target-server-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-server-backup
 spec:
diff --git a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-remote.yaml b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-remote.yaml
index f7e4e6b05..f1c4d152f 100644
--- a/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/tdarr/ReplicationSource-tdarr-server-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: tdarr-server-backup-source-remote
   namespace: tdarr
   labels:
-    helm.sh/chart: volsync-target-server-0.8.0
+    helm.sh/chart: volsync-target-server-1.0.0
     app.kubernetes.io/instance: tdarr
     app.kubernetes.io/part-of: tdarr
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: tdarr-server-backup
 spec:
diff --git a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-external.yaml b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-external.yaml
index d06ef1b9d..aa7383295 100644
--- a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: vaultwarden-data-backup-secret-external
   namespace: vaultwarden
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-data-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/vaultwarden/vaultwarden-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/vaultwarden/vaultwarden-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-local.yaml b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-local.yaml
index ff09cc755..519799554 100644
--- a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: vaultwarden-data-backup-secret-local
   namespace: vaultwarden
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-data-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/vaultwarden/vaultwarden-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/vaultwarden/vaultwarden-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-remote.yaml b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-remote.yaml
index 05f790b17..92aca2665 100644
--- a/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ExternalSecret-vaultwarden-data-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: vaultwarden-data-backup-secret-remote
   namespace: vaultwarden
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-data-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/vaultwarden/vaultwarden-data"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/vaultwarden/vaultwarden-data"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-external.yaml b/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-external.yaml
index d07af04c0..a382d3b2f 100644
--- a/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: vaultwarden-data-backup-source-external
   namespace: vaultwarden
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-local.yaml b/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-local.yaml
index d7058d785..cbf1ce987 100644
--- a/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: vaultwarden-data-backup-source-local
   namespace: vaultwarden
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-remote.yaml b/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-remote.yaml
index c7d0cb304..373c5d4f4 100644
--- a/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/vaultwarden/ReplicationSource-vaultwarden-data-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: vaultwarden-data-backup-source-remote
   namespace: vaultwarden
   labels:
-    helm.sh/chart: volsync-target-data-0.8.0
+    helm.sh/chart: volsync-target-data-1.0.0
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/part-of: vaultwarden
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: vaultwarden-data-backup
 spec:
diff --git a/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-external.yaml b/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-external.yaml
index bc8b1b066..d8bc66b9d 100644
--- a/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-external.yaml
+++ b/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-external.yaml
@@ -4,55 +4,44 @@ metadata:
   name: yubal-backup-secret-external
   namespace: yubal
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: yubal
     app.kubernetes.io/part-of: yubal
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: yubal-backup-secret-external
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/yubal/yubal"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/yubal/yubal"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /digital-ocean/config
+        property: ENDPOINT
+    - secretKey: BUCKET
+      remoteRef:
+        key: /digital-ocean/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
+        key: /digital-ocean/home-infra/volsync-backups
         property: RESTIC_PASSWORD
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
+        property: AWS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
         property: AWS_SECRET_ACCESS_KEY
diff --git a/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-local.yaml b/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-local.yaml
index 3b0d83969..7229a2afa 100644
--- a/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-local.yaml
+++ b/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-local.yaml
@@ -4,55 +4,44 @@ metadata:
   name: yubal-backup-secret-local
   namespace: yubal
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: yubal
     app.kubernetes.io/part-of: yubal
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: yubal-backup-secret-local
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/yubal/yubal"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/yubal/yubal"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_LOCAL
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_LOCAL
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-remote.yaml b/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-remote.yaml
index fdebcba80..54f250113 100644
--- a/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-remote.yaml
+++ b/clusters/cl01tl/manifests/yubal/ExternalSecret-yubal-backup-secret-remote.yaml
@@ -4,55 +4,44 @@ metadata:
   name: yubal-backup-secret-remote
   namespace: yubal
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: yubal
     app.kubernetes.io/part-of: yubal
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: yubal-backup-secret-remote
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   target:
     template:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/yubal/yubal"
+        RESTIC_REPOSITORY: "s3:{{ .ENDPOINT }}/{{ .BUCKET }}/cl01tl/yubal/yubal"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: ENDPOINT
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
+        key: /garage/config
+        property: ENDPOINT_REMOTE
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/volsync-backups
+        property: BUCKET
     - secretKey: RESTIC_PASSWORD
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
+        key: /garage/home-infra/volsync-backups
+        property: RESTIC_PASSWORD_REMOTE
     - secretKey: AWS_DEFAULT_REGION
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_REGION
     - secretKey: AWS_ACCESS_KEY_ID
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_KEY_ID
     - secretKey: AWS_SECRET_ACCESS_KEY
       remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
         key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
         property: ACCESS_SECRET_KEY
diff --git a/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-external.yaml b/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-external.yaml
index e13f427a7..3c3fb6539 100644
--- a/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-external.yaml
+++ b/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-external.yaml
@@ -4,10 +4,10 @@ metadata:
   name: yubal-backup-source-external
   namespace: yubal
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: yubal
     app.kubernetes.io/part-of: yubal
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: yubal-backup
 spec:
diff --git a/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-local.yaml b/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-local.yaml
index b03057686..3a494a28d 100644
--- a/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-local.yaml
+++ b/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-local.yaml
@@ -4,10 +4,10 @@ metadata:
   name: yubal-backup-source-local
   namespace: yubal
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: yubal
     app.kubernetes.io/part-of: yubal
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: yubal-backup
 spec:
diff --git a/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-remote.yaml b/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-remote.yaml
index 3f07e4068..b16be2023 100644
--- a/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-remote.yaml
+++ b/clusters/cl01tl/manifests/yubal/ReplicationSource-yubal-backup-source-remote.yaml
@@ -4,10 +4,10 @@ metadata:
   name: yubal-backup-source-remote
   namespace: yubal
   labels:
-    helm.sh/chart: volsync-target-config-0.8.0
+    helm.sh/chart: volsync-target-config-1.0.0
     app.kubernetes.io/instance: yubal
     app.kubernetes.io/part-of: yubal
-    app.kubernetes.io/version: "0.8.0"
+    app.kubernetes.io/version: "1.0.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: yubal-backup
 spec: