diff --git a/helmfile/environments/default/external_secrets.yaml.gotmpl b/helmfile/environments/default/external_secrets.yaml.gotmpl
index 33fd2222..67891120 100644
--- a/helmfile/environments/default/external_secrets.yaml.gotmpl
+++ b/helmfile/environments/default/external_secrets.yaml.gotmpl
@@ -4,14 +4,22 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 externalSecrets:
-  minio:
-    existingSecret: ~
-    rootUserSecretKey: ~
-    rootPasswordSecretKey: ~
-    usersExistingSecrets: []
-  redis:
-    existingSecret: ~
-    existingSecretPasswordKey: ~
+  cache:
+    nextcloudUsername:
+      name: ~
+      key: ~
+    nextcloudPassword:
+      name: ~
+      key: ~
+  cassandra:
+    initDBSecret: ~
+    existingSecret:
+      name: ~
+      passwordKey: ~
+  centralnavigation:
+    apiKey:
+      name: ~
+      key: ~
   certificates:
     password :
       name: ~
@@ -21,30 +29,31 @@ externalSecrets:
       name: ~
       passwordKey: ~
       usernameKey: ~
-  cassandra:
-    initDBSecret: ~
-    existingSecret:
-      name: ~
-      passwordKey: ~
-  cache:
-    nextcloudUsername:
-      name: ~
-      key: ~
-    nextcloudPassword:
-      name: ~
-      key: ~
-  centralnavigation:
-    apiKey:
-      name: ~
-      key: ~
+  databases:
+    nextcloud:
+      password:
+        name: ~
+        key: ~
+      username:
+        name: ~
+        key: ~
+    xwiki:
+      password:
+        name:  ~
+        key: ~
   keycloak:
+    clientSecret:
+      xwiki:
+        name: ~
+        key: ~
     clientSecretNcoidc:
       name: ~
       key: ~
-  mariadb:
-    nextcloudUser:
-      name: ~
-      key: ~
+  minio:
+    existingSecret: ~
+    rootUserSecretKey: ~
+    rootPasswordSecretKey: ~
+    usersExistingSecrets: []
   nextcloud:
     adminPassword:
       name: ~
@@ -60,6 +69,9 @@ externalSecrets:
       nextcloud:
         name: ~
         key: ~
+      xwiki:
+        name: ~
+        key: ~
   objectstores:
     nextcloudAccessKey:
       name: ~
@@ -67,43 +79,20 @@ externalSecrets:
     nextcloudSecretKey:
       name: ~
       key: ~
-  postfix:
-    opendeskSystemPassword:
-      name: ~
-      key: ~
-  postgresql:
-    nextcloudUser:
   openproject:
     apiAdminPassword:
       name: ~
       key: ~
     apiAdminUsername:
-  centralnavigation:
-    apiKey:
       name: ~
       key: ~
-  certificates:
-    password:
-      name: ~
-      key: ~
-  keycloak:
-    clientSecret:
-      xwiki:
-        name: ~
-        key: ~
-  nubus:
-    ldapSearch:
-      xwiki:
-        name: ~
-        key: ~
-  mariadb:
-    rootPassword:
-      name: ~
-      key: ~
-  postgresql:
-    xwikiUser:
+  postfix:
+    opendeskSystemPassword:
       name: ~
       key: ~
+  redis:
+    existingSecret: ~
+    existingSecretPasswordKey: ~
   xwiki:
     xwikiSuperadminpassword:
       name: ~