diff --git a/kubernetes/flux/apps.yaml b/kubernetes/flux/apps.yaml
index d38f4d15..6d149154 100644
--- a/kubernetes/flux/apps.yaml
+++ b/kubernetes/flux/apps.yaml
@@ -21,3 +21,22 @@ spec:
         name: cluster-settings
       - kind: Secret
         name: cluster-secrets
+  patches:
+    - patch: |-
+        apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+        kind: Kustomization
+        metadata:
+          name: not-used
+        spec:
+          decryption:
+            provider: sops
+            secretRef:
+              name: sops-age
+          postBuild:
+            substituteFrom:
+              - kind: ConfigMap
+                name: cluster-settings
+              - kind: Secret
+                name: cluster-secrets
+      target:
+        labelSelector: substitution.flux.home.arpa/enabled=true