diff --git a/environment-provisioner/cluster-secret-store.yaml b/environment-provisioner/cluster-secret-store.yaml
new file mode 100644
index 0000000..a6b5cf7
--- /dev/null
+++ b/environment-provisioner/cluster-secret-store.yaml
@@ -0,0 +1,23 @@
+---
+# ClusterSecretStore for GCP Secret Manager
+# Uses Workload Identity for authentication (recommended for GKE)
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: gcpsm-secret-store
+spec:
+  provider:
+    gcpsm:
+      # GCP Project ID where secrets are stored
+      projectID: prj-onlinesales-test-framework
+      # Authentication via Workload Identity
+      # The external-secrets controller ServiceAccount must be annotated with:
+      # iam.gke.io/gcp-service-account: <GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com
+      auth:
+        workloadIdentity:
+          clusterLocation: asia-south1
+          clusterName: backstage-cluster
+          clusterProjectID: prj-onlinesales-test-framework
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets-system