diff --git a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
index 10688fcef..838a01f34 100644
--- a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+matrix-synapse
+{{- end -}}
diff --git a/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml b/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
index 02b79d5ea..838b68083 100644
--- a/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
@@ -1,159 +1,40 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-synapse-config-secret
+  name: matrix-synapse-signing-key
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: matrix-synapse-config-secret
+    app.kubernetes.io/name: matrix-synapse-signing-key
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: oidc.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/config
-        property: oidc.yaml
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/config
-        property: config.yaml
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-signingkey
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-signingkey
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: signing.key
       remoteRef:
-        key: /cl01tl/matrix-synapse/config
+        key: /cl01tl/matrix-synapse/key
         property: signing-key
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-hookshot-config-secret
+  name: matrix-synapse-valkey-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: matrix-hookshot-config-secret
+    app.kubernetes.io/name: matrix-synapse-valkey-config
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: config
-    - secretKey: registration.yml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: registration
-    - secretKey: hookshot-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: registration
-    - secretKey: passkey.pem
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: passkey
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        property: config
-    - secretKey: mautrix-discord-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        property: registration
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-config-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        property: config
-    - secretKey: mautrix-whatsapp-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        property: registration
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: double-puppet-registration-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: double-puppet-registration-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: double-puppet-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/double-puppet
-        property: registration
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-valkey-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-valkey-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: default
       remoteRef:
-        key: /cl01tl/matrix-synapse/redis
+        key: /cl01tl/matrix-synapse/valkey
         property: password
     - secretKey: password
       remoteRef:
-        key: /cl01tl/matrix-synapse/redis
+        key: /cl01tl/matrix-synapse/valkey
         property: password
diff --git a/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml b/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
new file mode 100644
index 000000000..ddf8f3796
--- /dev/null
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
@@ -0,0 +1,114 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: config.yaml
+      - objectName: oidc.yaml
+        fileName: oidc.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: oidc.yaml
+      - objectName: hookshot-registration.yaml
+        fileName: hookshot-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml
+      - objectName: double-puppet-registration.yaml
+        fileName: double-puppet-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
+        secretKey: double-puppet-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-hookshot-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yml
+        fileName: config.yml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: config.yml
+      - objectName: registration.yml
+        fileName: registration.yml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
+      - objectName: passkey.pem
+        fileName: passkey.pem
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: passkey.pem
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: mautrix-discord-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: config.yaml
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: mautrix-whatsapp-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-whatsapp-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: config.yaml
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml
diff --git a/clusters/cl01tl/helm/matrix-synapse/templates/service-account.yaml b/clusters/cl01tl/helm/matrix-synapse/templates/service-account.yaml
new file mode 100644
index 000000000..5db759b3e
--- /dev/null
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/service-account.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
diff --git a/clusters/cl01tl/helm/matrix-synapse/values.yaml b/clusters/cl01tl/helm/matrix-synapse/values.yaml
index d2c6ae39b..c91ffc81a 100644
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -8,7 +8,7 @@ matrix-synapse:
   signingkey:
     job:
       enabled: false
-    existingSecret: matrix-synapse-signingkey
+    existingSecret: matrix-synapse-signing-key
     existingSecretKey: signing.key
   config:
     reportStats: false
@@ -37,45 +37,16 @@ matrix-synapse:
     strategy:
       type: Recreate
     extraVolumes:
-      - name: matrix-synapse-config-secret
-        secret:
-          secretName: matrix-synapse-config-secret
-      - name: matrix-hookshot-config-secret
-        secret:
-          secretName: matrix-hookshot-config-secret
-      - name: mautrix-discord-config-secret
-        secret:
-          secretName: mautrix-discord-config-secret
-      - name: mautrix-whatsapp-config-secret
-        secret:
-          secretName: mautrix-whatsapp-config-secret
-      - name: double-puppet-registration-secret
-        secret:
-          secretName: double-puppet-registration-secret
+      - name: config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-config
     extraVolumeMounts:
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/oidc.yaml
-        subPath: oidc.yaml
-        readOnly: true
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/config.yaml
-        subPath: config.yaml
-        readOnly: true
-      - name: matrix-hookshot-config-secret
-        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
-        subPath: hookshot-registration.yaml
-        readOnly: true
-      - name: mautrix-discord-config-secret
-        mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
-        subPath: mautrix-discord-registration.yaml
-        readOnly: true
-      - name: mautrix-whatsapp-config-secret
-        mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
-        subPath: mautrix-whatsapp-registration.yaml
-        readOnly: true
-      - name: double-puppet-registration-secret
-        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
-        subPath: double-puppet-registration.yaml
+      - name: config
+        mountPath: /synapse/config/conf.d
+        mountPropagation: None
         readOnly: true
     resources:
       requests:
@@ -120,7 +91,7 @@ matrix-synapse:
   externalRedis:
     host: matrix-synapse-valkey
     port: 6379
-    existingSecret: matrix-synapse-valkey-secret
+    existingSecret: matrix-synapse-valkey-config
     existingSecretPasswordKey: password
   persistence:
     enabled: true
@@ -186,9 +157,13 @@ matrix-hookshot:
           path: /metrics
   persistence:
     config:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-hookshot-config
       advancedMounts:
         main:
           main:
@@ -197,9 +172,13 @@ matrix-hookshot:
               mountPropagation: None
               subPath: config.yml
     registration:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-hookshot-config
       advancedMounts:
         main:
           main:
@@ -208,9 +187,13 @@ matrix-hookshot:
               mountPropagation: None
               subPath: registration.yml
     passkey:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-hookshot-config
       advancedMounts:
         main:
           main:
@@ -270,27 +253,19 @@ mautrix-discord:
           targetPort: 29334
   persistence:
     config:
-      enabled: true
-      type: secret
-      name: mautrix-discord-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: mautrix-discord-config
       advancedMounts:
         main:
           init-copy-config:
-            - path: /tmp/config.yaml
+            - path: /tmp
               readOnly: true
               mountPropagation: None
-              subPath: config.yaml
-    registration:
-      enabled: true
-      type: secret
-      name: mautrix-discord-config-secret
-      advancedMounts:
-        main:
-          init-copy-config:
-            - path: /tmp/mautrix-discord-registration.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: mautrix-discord-registration.yaml
     data:
       forceRename: mautrix-discord
       storageClass: ceph-block
@@ -346,27 +321,19 @@ mautrix-whatsapp:
           targetPort: 29318
   persistence:
     config:
-      enabled: true
-      type: secret
-      name: mautrix-whatsapp-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: mautrix-whatsapp-config
       advancedMounts:
         main:
           init-copy-config:
-            - path: /tmp/config.yaml
+            - path: /tmp
               readOnly: true
               mountPropagation: None
-              subPath: config.yaml
-    registration:
-      enabled: true
-      type: secret
-      name: mautrix-whatsapp-config-secret
-      advancedMounts:
-        main:
-          init-copy-config:
-            - path: /tmp/mautrix-whatsapp-registration.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: mautrix-whatsapp-registration.yaml
     data:
       forceRename: mautrix-whatsapp
       storageClass: ceph-block
@@ -414,7 +381,7 @@ valkey-matrix-synapse:
   valkey:
     auth:
       enabled: true
-      usersExistingSecret: matrix-synapse-valkey-secret
+      usersExistingSecret: matrix-synapse-valkey-config
       aclUsers:
         default:
           permissions: "~* &* +@all"