diff --git a/services/foundryvtt/foundry-vtt-account.yaml b/services/foundryvtt/foundry-vtt-account.yaml
new file mode 100644
index 0000000..60fec67
--- /dev/null
+++ b/services/foundryvtt/foundry-vtt-account.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: foundry-vtt-sa
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: foundry-vtt-auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: foundry-vtt-sa
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: system:auth-delegator
+  apiGroup: rbac.authorization.k8s.io
diff --git a/services/foundryvtt/foundry-vtt-deployment.yaml b/services/foundryvtt/foundry-vtt-deployment.yaml
index 5a8c971..af3d79f 100644
--- a/services/foundryvtt/foundry-vtt-deployment.yaml
+++ b/services/foundryvtt/foundry-vtt-deployment.yaml
@@ -19,41 +19,32 @@ spec:
       annotations:
         kompose.cmd: kompose convert -f foundry-compose.yml
         kompose.version: 1.38.0 (HEAD)
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: "foundry-role"
+        vault.hashicorp.com/agent-inject-secret-credentials: "secret/data/foundry-vtt/config"
+        vault.hashicorp.com/agent-inject-template-credentials: |
+          {{- with secret "secret/data/foundry-vtt/config" -}}
+          export FOUNDRY_ADMIN_KEY="{{ .Data.data.admin_key }}"
+          export FOUNDRY_LICENSE_KEY="{{ .Data.data.license_key }}"
+          export FOUNDRY_PASSWORD="{{ .Data.data.password }}"
+          export FOUNDRY_USERNAME="{{ .Data.data.username }}"
+          {{- end -}}
       labels:
         io.kompose.service: foundry-vtt
     spec:
+      serviceAccountName: foundry-vtt-sa
       containers:
-        - env:
-            - name: CONTAINER_PRESERVE_CONFIG
-              value: "true"
-            - name: FOUNDRY_ADMIN_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: main-pass
-                  key: password
-            - name: FOUNDRY_LICENSE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: foundry-license-key
-                  key: license_key
-            - name: FOUNDRY_MINIFY_STATIC_FILES
-              value: "true"
-            - name: FOUNDRY_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: foundry-password
-                  key: password
-            - name: FOUNDRY_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: foundry-user
-                  key: user
+        - name: foundry-vtt
           image: felddy/foundryvtt:release
-          name: foundry-vtt
           ports:
             - containerPort: 30000
               protocol: TCP
               name: web-ui
+          env:
+            - name: CONTAINER_PRESERVE_CONFIG
+              value: "true"
+            - name: FOUNDRY_MINIFY_STATIC_FILES
+              value: "true"
           volumeMounts:
             - mountPath: /data
               name: foundry-vtt-volume
diff --git a/services/lazy-librarian/lazylibrarian-account.yaml b/services/lazy-librarian/lazylibrarian-account.yaml
new file mode 100644
index 0000000..be6eb67
--- /dev/null
+++ b/services/lazy-librarian/lazylibrarian-account.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: lazylibrarian-sa
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: lazylibrarian-auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: lazylibrarian-sa
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: system:auth-delegator
+  apiGroup: rbac.authorization.k8s.io
diff --git a/services/lazy-librarian/lazylibrarian-deployment.yaml b/services/lazy-librarian/lazylibrarian-deployment.yaml
index 097e01b..42ade99 100644
--- a/services/lazy-librarian/lazylibrarian-deployment.yaml
+++ b/services/lazy-librarian/lazylibrarian-deployment.yaml
@@ -19,9 +19,17 @@ spec:
       annotations:
         kompose.cmd: kompose convert -f compose-ll.yaml
         kompose.version: 1.38.0 (HEAD)
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: "lazylibrarian-role"
+        vault.hashicorp.com/agent-inject-secret-credentials: "secret/data/lazylibrarian/config"
+        vault.hashicorp.com/agent-inject-template-credentials: |
+          {{- with secret "secret/data/lazylibrarian/config" -}}
+          export HARDCOVER_API_KEY="{{ .Data.data.hardcover_api_key }}"
+          {{- end -}}
       labels:
         io.kompose.service: lazylibrarian
     spec:
+      serviceAccountName: lazylibrarian-sa
       containers:
         - env:
             - name: DOCKER_MODS
@@ -32,11 +40,6 @@ spec:
               value: "1000"
             - name: TZ
               value: America/New_York
-            - name: HARDCOVER_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: hardcover-api-key
-                  key: key
           image: lscr.io/linuxserver/lazylibrarian:latest
           name: lazylibrarian
           ports:
diff --git a/services/navidrome/navidrome-account.yaml b/services/navidrome/navidrome-account.yaml
new file mode 100644
index 0000000..35424bd
--- /dev/null
+++ b/services/navidrome/navidrome-account.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: navidrome-sa
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: navidrome-auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: navidrome-sa
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: system:auth-delegator
+  apiGroup: rbac.authorization.k8s.io
diff --git a/services/navidrome/navidrome-deployment.yaml b/services/navidrome/navidrome-deployment.yaml
index 3088608..89ebd06 100644
--- a/services/navidrome/navidrome-deployment.yaml
+++ b/services/navidrome/navidrome-deployment.yaml
@@ -19,23 +19,24 @@ spec:
       annotations:
         kompose.cmd: kompose convert -f compose-navidrome.yaml
         kompose.version: 1.38.0 (HEAD)
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: "navidrome-role"
+        vault.hashicorp.com/agent-inject-secret-credentials: "secret/data/navidrome/config"
+        vault.hashicorp.com/agent-inject-template-credentials: |
+          {{- with secret "secret/data/navidrome/config" -}}
+          export ND_LASTFM_APIKEY="{{ .Data.data.lastfm_api_key }}"
+          export ND_LASTFM_SECRET="{{ .Data.data.lastfm_secret }}"
+          {{- end -}}
       labels:
         io.kompose.service: navidrome
     spec:
+      serviceAccountName: navidrome-sa
       containers:
         - env:
             - name: ND_LASTFM_APIKEY
-              valueFrom:
-                secretKeyRef:
-                  name: lastfm-api-key
-                  key: api_key
             - name: ND_LASTFM_ENABLED
               value: "true"
             - name: ND_LASTFM_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: lastfm-secret
-                  key: secret
             - name: TZ
               value: America/New_York
           image: deluan/navidrome:latest