diff --git a/services/forgejo/forgejo-external-secrets.yaml b/services/forgejo/forgejo-external-secrets.yaml
index 48475e1..a61e9ff 100644
--- a/services/forgejo/forgejo-external-secrets.yaml
+++ b/services/forgejo/forgejo-external-secrets.yaml
@@ -61,3 +61,32 @@ spec:
       remoteRef:
         key: forgejo
         property: ecdsa_key
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-registry-secret
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-external-secrets-store
+  target:
+    name: forgejo-registry-secret
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: '{"auths":{"{{ .server }}":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}'
+  data:
+    - secretKey: username
+      remoteRef:
+        key: forgejo
+        property: registry-user
+    - secretKey: password
+      remoteRef:
+        key: forgejo
+        property: registry-pass
+    - secretKey: server
+      remoteRef:
+        key: forgejo
+        property: registry-server