diff --git a/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse.yaml b/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse.yaml
index 200d2a191..d2bc2cea3 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/Deployment-matrix-synapse.yaml
@@ -112,10 +112,36 @@ spec:
               mountPath: /synapse/data
             - name: tmpdir
               mountPath: /tmp
-            - mountPath: /synapse/config/conf.d
+            - mountPath: /synapse/config/conf.d/config.yaml
               mountPropagation: None
               name: config
               readOnly: true
+              subPath: config.yaml
+            - mountPath: /synapse/config/conf.d/
+              mountPropagation: None
+              name: oidc-config
+              readOnly: true
+              subPath: oidc.yaml
+            - mountPath: /synapse/config/conf.d/
+              mountPropagation: None
+              name: hookshot-config
+              readOnly: true
+              subPath: hookshot-registration.yaml
+            - mountPath: /synapse/config/conf.d/
+              mountPropagation: None
+              name: mautrix-discord-config
+              readOnly: true
+              subPath: mautrix-discord-registration.yaml
+            - mountPath: /synapse/config/conf.d/
+              mountPropagation: None
+              name: mautrix-whatsapp-config
+              readOnly: true
+              subPath: mautrix-whatsapp-registration.yaml
+            - mountPath: /synapse/config/conf.d/
+              mountPropagation: None
+              name: double-puppet-config
+              readOnly: true
+              subPath: double-puppet-registration.yaml
           resources:
             requests:
               cpu: 10m
@@ -146,3 +172,33 @@ spec:
             volumeAttributes:
               secretProviderClass: matrix-synapse-config
           name: config
+        - csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: matrix-synapse-oidc-config
+          name: oidc-config
+        - csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: matrix-synapse-hookshot-config
+          name: hookshot-config
+        - csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: matrix-synapse-mautrix-discord-config
+          name: mautrix-discord-config
+        - csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: matrix-synapse-mautrix-whatsapp-config
+          name: mautrix-whatsapp-config
+        - csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: matrix-synapse-double-puppet-config
+          name: double-puppet-config
diff --git a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-config.yaml b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-config.yaml
index a97084f68..b2aee216a 100644
--- a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-config.yaml
+++ b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-config.yaml
@@ -17,23 +17,3 @@ spec:
         fileName: config.yaml
         secretPath: secret/data/cl01tl/matrix-synapse/config
         secretKey: config.yaml
-      - objectName: oidc.yaml
-        fileName: oidc.yaml
-        secretPath: secret/data/cl01tl/matrix-synapse/config
-        secretKey: oidc.yaml
-      - objectName: hookshot-registration.yaml
-        fileName: hookshot-registration.yaml
-        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
-        secretKey: hookshot-registration.yaml
-      - objectName: mautrix-discord-registration.yaml
-        fileName: mautrix-discord-registration.yaml
-        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
-        secretKey: mautrix-discord-registration.yaml
-      - objectName: mautrix-whatsapp-registration.yaml
-        fileName: mautrix-whatsapp-registration.yaml
-        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
-        secretKey: mautrix-whatsapp-registration.yaml
-      - objectName: double-puppet-registration.yaml
-        fileName: double-puppet-registration.yaml
-        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
-        secretKey: double-puppet-registration.yaml
diff --git a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-double-puppet-config.yaml b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-double-puppet-config.yaml
new file mode 100644
index 000000000..b4d580698
--- /dev/null
+++ b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-double-puppet-config.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-double-puppet-config
+  namespace: matrix-synapse
+  labels:
+    app.kubernetes.io/name: matrix-synapse-double-puppet-config
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/part-of: matrix-synapse
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: double-puppet-registration.yaml
+        fileName: double-puppet-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
+        secretKey: double-puppet-registration.yaml
diff --git a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-hookshot-config.yaml b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-hookshot-config.yaml
new file mode 100644
index 000000000..1067835ff
--- /dev/null
+++ b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-hookshot-config.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-hookshot-config
+  namespace: matrix-synapse
+  labels:
+    app.kubernetes.io/name: matrix-synapse-hookshot-config
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/part-of: matrix-synapse
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: hookshot-registration.yaml
+        fileName: hookshot-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
diff --git a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-mautrix-discord-config.yaml b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-mautrix-discord-config.yaml
new file mode 100644
index 000000000..fd6d1b177
--- /dev/null
+++ b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-mautrix-discord-config.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-mautrix-discord-config
+  namespace: matrix-synapse
+  labels:
+    app.kubernetes.io/name: matrix-synapse-mautrix-discord-config
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/part-of: matrix-synapse
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
diff --git a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-mautrix-whatsapp-config.yaml b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-mautrix-whatsapp-config.yaml
new file mode 100644
index 000000000..efaeedade
--- /dev/null
+++ b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-mautrix-whatsapp-config.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-mautrix-whatsapp-config
+  namespace: matrix-synapse
+  labels:
+    app.kubernetes.io/name: matrix-synapse-mautrix-whatsapp-config
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/part-of: matrix-synapse
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml
diff --git a/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-oidc-config.yaml b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-oidc-config.yaml
new file mode 100644
index 000000000..9693156ec
--- /dev/null
+++ b/clusters/cl01tl/manifests/matrix-synapse/SecretProviderClass-matrix-synapse-oidc-config.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-oidc-config
+  namespace: matrix-synapse
+  labels:
+    app.kubernetes.io/name: matrix-synapse-oidc-config
+    app.kubernetes.io/instance: matrix-synapse
+    app.kubernetes.io/part-of: matrix-synapse
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: oidc.yaml
+        fileName: oidc.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: oidc.yaml