diff --git a/README.md b/README.md
index 923a651b..6f86904b 100644
--- a/README.md
+++ b/README.md
@@ -172,11 +172,11 @@ export BOOTSTRAP_DOMAIN_CERT="k8s-at-home"
 export BOOTSTRAP_CLOUDFLARE_TOKEN="dsKq41iLAbXE37GV"
 export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10"
 
-envsubst < ./.sops.yaml > ./.sops.yaml.tmp && mv ./.sops.yaml.tmp ./.sops.yaml
-envsubst < ./cluster/cluster-secrets.yaml > ./cluster/cluster-secrets.yaml.tmp && mv ./cluster/cluster-secrets.yaml.tmp ./cluster/cluster-secrets.yaml
-envsubst < ./cluster/cluster-settings.yaml > ./cluster/cluster-settings.yaml.tmp && mv ./cluster/cluster-settings.yaml.tmp ./cluster/cluster-settings.yaml
-envsubst < ./cluster/base/flux-system/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml.tmp && mv ./cluster/base/flux-system/gotk-sync.yaml.tmp ./cluster/base/flux-system/gotk-sync.yaml
-envsubst < ./cluster/core/cert-manager/secret.enc.yaml > ./cluster/core/cert-manager/secret.enc.yaml.tmp && mv ./cluster/core/cert-manager/secret.enc.yaml.tmp ./cluster/core/cert-manager/secret.enc.yaml
+envsubst < ./tmpl/.sops.yaml > ./.sops.yaml
+envsubst < ./tmpl/cluster-secrets.yaml > ./cluster/cluster-secrets.yaml
+envsubst < ./tmpl/cluster-settings.yaml > ./cluster/cluster-settings.yaml
+envsubst < ./tmpl/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml
+envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/infrastructure/cert-manager/secret.enc.yaml
 ```
 
 4. **Verify** all the above files have the correct information present
diff --git a/.sops.yaml b/tmpl/.sops.yaml
similarity index 100%
rename from .sops.yaml
rename to tmpl/.sops.yaml
diff --git a/cluster/base/cluster-secrets.yaml b/tmpl/cluster-secrets.yaml
similarity index 100%
rename from cluster/base/cluster-secrets.yaml
rename to tmpl/cluster-secrets.yaml
diff --git a/cluster/base/cluster-settings.yaml b/tmpl/cluster-settings.yaml
similarity index 100%
rename from cluster/base/cluster-settings.yaml
rename to tmpl/cluster-settings.yaml
diff --git a/cluster/base/flux-system/gotk-sync.yaml b/tmpl/gotk-sync.yaml
similarity index 100%
rename from cluster/base/flux-system/gotk-sync.yaml
rename to tmpl/gotk-sync.yaml
diff --git a/tmpl/secret.enc.yaml b/tmpl/secret.enc.yaml
new file mode 100644
index 00000000..6308663c
--- /dev/null
+++ b/tmpl/secret.enc.yaml
@@ -0,0 +1,8 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-token-secret
+    namespace: cert-manager
+stringData:
+    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}