diff --git a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
index ee955a14..c798b2f7 100644
--- a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
@@ -72,6 +72,9 @@ job:
 mariadb:
   rootPassword:
     value: {{ .Values.secrets.mariadb.rootPassword | quote }}
+    existingSecret:
+      name: {{ .Values.external_secrets.mariadb.rootPassword.name | quote }}
+      key: {{ .Values.external_secrets.mariadb.rootPassword.key | quote }}
 
 persistence:
   size: {{ .Values.persistence.storages.mariadb.size | quote }}
diff --git a/helmfile/environments/default/external_secrets.yaml.gotmpl b/helmfile/environments/default/external_secrets.yaml.gotmpl
new file mode 100644
index 00000000..6d74d87e
--- /dev/null
+++ b/helmfile/environments/default/external_secrets.yaml.gotmpl
@@ -0,0 +1,11 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+external_secrets:
+  mariadb:
+    rootPassword:
+      name: ~
+      key: ~
+...
\ No newline at end of file