diff --git a/environment-provisioner/external-secrets.yaml b/environment-provisioner/external-secrets.yaml
index 997be4f..98b67ec 100644
--- a/environment-provisioner/external-secrets.yaml
+++ b/environment-provisioner/external-secrets.yaml
@@ -1,6 +1,6 @@
 ---
 # ExternalSecret for Gitea credentials
-# Syncs secrets from GCP Secret Manager to Kubernetes
+# Syncs secrets from GCP Secret Manager (backstage-secrets JSON) to Kubernetes
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -17,13 +17,16 @@ spec:
   data:
     - secretKey: url
       remoteRef:
-        key: gitea-url
+        key: backstage-secrets
+        property: GITEA_URL
     - secretKey: username
       remoteRef:
-        key: gitea-username
+        key: backstage-secrets
+        property: GITEA_USERNAME
     - secretKey: password
       remoteRef:
-        key: gitea-password
+        key: backstage-secrets
+        property: GITEA_PASSWORD
 ---
 # ExternalSecret for ArgoCD credentials
 apiVersion: external-secrets.io/v1beta1
@@ -42,13 +45,16 @@ spec:
   data:
     - secretKey: server
       remoteRef:
-        key: argocd-server
+        key: backstage-secrets
+        property: ARGOCD_SERVER
     - secretKey: username
       remoteRef:
-        key: argocd-username
+        key: backstage-secrets
+        property: ARGOCD_USERNAME
     - secretKey: password
       remoteRef:
-        key: argocd-password
+        key: backstage-secrets
+        property: ARGOCD_AUTH_TOKEN
 ---
 # ExternalSecret for Argo Workflows token (for Backstage)
 # This secret is created in the backstage namespace
@@ -68,4 +74,5 @@ spec:
   data:
     - secretKey: token
       remoteRef:
-        key: argo-workflows-token
+        key: backstage-secrets
+        property: ARGO_WORKFLOWS_TOKEN