diff --git a/charts/supabase/Chart.yaml b/charts/supabase/Chart.yaml
index d7b9a1fc9f54ac603cc518e7ae9bdee9b7c5eb9a..b83d3422125885ca2c2e9923a600db6ad2d70769 100644
--- a/charts/supabase/Chart.yaml
+++ b/charts/supabase/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: 0.1.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/supabase/templates/analytics/deployment.yaml b/charts/supabase/templates/analytics/deployment.yaml
index 3f11bb921c87fc41ee6a870db23ab0a74c14a81d..3c4f585c2dc5e6aca3ea8053afeb615d3f54f345 100644
--- a/charts/supabase/templates/analytics/deployment.yaml
+++ b/charts/supabase/templates/analytics/deployment.yaml
@@ -42,8 +42,13 @@ spec:
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: username
+                  {{- end }}
             - name: DB_PORT
               value: {{ .Values.analytics.environment.DB_PORT | quote }}
           command: ["/bin/sh", "-c"]
@@ -72,23 +77,43 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_PASSWORD_ENC
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password_encoded
+                  {{- end }}
             - name: DB_DATABASE
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: LOGFLARE_API_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.analytics.secretRef }}
+                  name: {{ .Values.secret.analytics.secretRef }}
+                  key: {{ .Values.secret.analytics.secretRefKey.apiKey | default "apiKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.analytics" . }}
                   key: apiKey
+                  {{- end }}
             {{- if .Values.analytics.bigQuery.enabled }}
             - name: GOOGLE_PROJECT_ID
               value: {{ .Values.analytics.bigQuery.projectId | quote }}
diff --git a/charts/supabase/templates/auth/deployment.yaml b/charts/supabase/templates/auth/deployment.yaml
index b2ee0b42cbdc4f5522135fa946f4b4567b41b4a2..f3830453f8afd9d2c226bdd2eab9fac78be10df8 100644
--- a/charts/supabase/templates/auth/deployment.yaml
+++ b/charts/supabase/templates/auth/deployment.yaml
@@ -42,8 +42,13 @@ spec:
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: username
+                  {{- end }}
             - name: DB_PORT
               value: {{ .Values.auth.environment.DB_PORT | quote }}
           command: ["/bin/sh", "-c"]
@@ -72,18 +77,33 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_PASSWORD_ENC
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password_encoded
+                  {{- end }}
             - name: DB_NAME
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: GOTRUE_DB_DATABASE_URL
               value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@$(DB_HOST):$(DB_PORT)/$(DB_NAME)?search_path=auth&sslmode=$(DB_SSL)
             - name: GOTRUE_DB_DRIVER
@@ -91,18 +111,33 @@ spec:
             - name: GOTRUE_JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: secret
+                  {{- end }}
             - name: GOTRUE_SMTP_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.smtp.secretRef }}
+                  name: {{ .Values.secret.smtp.secretRef }}
+                  key: {{ .Values.secret.smtp.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.smtp" . }}
                   key: username
+                  {{- end }}
             - name: GOTRUE_SMTP_PASS
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.smtp.secretRef }}
+                  name: {{ .Values.secret.smtp.secretRef }}
+                  key: {{ .Values.secret.smtp.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.smtp" . }}
                   key: password
+                  {{- end }}
           {{- with .Values.auth.livenessProbe }}
           livenessProbe:
             {{- toYaml . | nindent 12 }}
diff --git a/charts/supabase/templates/db/deployment.yaml b/charts/supabase/templates/db/deployment.yaml
index 13da44b807f5c35314274becbf64be08ca137a30..75f3c8effee3964743014fc2568a01c917480c11 100644
--- a/charts/supabase/templates/db/deployment.yaml
+++ b/charts/supabase/templates/db/deployment.yaml
@@ -66,28 +66,53 @@ spec:
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: username
+                  {{- end }}
             - name: PGPASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: PGDATABASE
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: POSTGRES_DB
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
           {{- with .Values.db.livenessProbe }}
           livenessProbe:
             {{- toYaml . | nindent 12 }}
diff --git a/charts/supabase/templates/functions/deployment.yaml b/charts/supabase/templates/functions/deployment.yaml
index 3bf7a7d9ecfa0641a5c5664b5b97209b4e078621..22726897ec2c2058ff577d40f834007d99ba5c10 100644
--- a/charts/supabase/templates/functions/deployment.yaml
+++ b/charts/supabase/templates/functions/deployment.yaml
@@ -52,33 +52,63 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_PASSWORD_ENC
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password_encoded
+                  {{- end }}
             - name: DB_DATABASE
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: secret
+                  {{- end }}
             - name: SUPABASE_ANON_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.anonKey | default "anonKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: anonKey
+                  {{- end }}
             - name: SUPABASE_SERVICE_ROLE_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.serviceKey | default "serviceKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: serviceKey
+                  {{- end }}
             - name: POSTGRES_BACKEND_URL
               value: $(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@$(DB_HOSTNAME):$(DB_PORT)/$(DB_DATABASE)?search_path=auth&sslmode=$(DB_SSL)
           {{- with .Values.functions.livenessProbe }}
diff --git a/charts/supabase/templates/kong/deployment.yaml b/charts/supabase/templates/kong/deployment.yaml
index 173c470daceba5cf5fc0b807fc87cb830d43f13f..fcedfbbd28d25b66aaadf743af62f82d59733a83 100644
--- a/charts/supabase/templates/kong/deployment.yaml
+++ b/charts/supabase/templates/kong/deployment.yaml
@@ -44,24 +44,44 @@ spec:
             - name: SUPABASE_ANON_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.anonKey | default "anonKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: anonKey
+                  {{- end }}
             - name: SUPABASE_SERVICE_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.serviceKey | default "serviceKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: serviceKey
+                  {{- end }}
             {{- if .Values.secret.dashboard }}
             - name: DASHBOARD_USERNAME
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.dashboard.secretRef }}
+                  name: {{ .Values.secret.dashboard.secretRef }}
+                  key: {{ .Values.secret.dashboard.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.dashboard" . }}
                   key: username
+                  {{- end }}
             - name: DASHBOARD_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.dashboard.secretRef }}
+                  name: {{ .Values.secret.dashboard.secretRef }}
+                  key: {{ .Values.secret.dashboard.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.dashboard" . }}
                   key: password
+                  {{- end }}
             {{- end }}
           {{- with .Values.kong.livenessProbe }}
           livenessProbe:
diff --git a/charts/supabase/templates/meta/deployment.yaml b/charts/supabase/templates/meta/deployment.yaml
index 254371a5b33139da3ac5ca4d0e35593a9673a595..2dac17b52caca572b192ac037d122d161d662e60 100644
--- a/charts/supabase/templates/meta/deployment.yaml
+++ b/charts/supabase/templates/meta/deployment.yaml
@@ -46,13 +46,23 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_NAME
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: PG_META_DB_HOST
               value: $(DB_HOST)
             - name: PG_META_DB_PORT
diff --git a/charts/supabase/templates/realtime/deployment.yaml b/charts/supabase/templates/realtime/deployment.yaml
index dcc0c043297b5c92f7fdb762f7e1dd50ef4520d7..4083a46f5a241bc283e295eca357ee16798b4bcb 100644
--- a/charts/supabase/templates/realtime/deployment.yaml
+++ b/charts/supabase/templates/realtime/deployment.yaml
@@ -42,8 +42,13 @@ spec:
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: username
+                  {{- end }}
             - name: DB_PORT
               value: {{ .Values.analytics.environment.DB_PORT | quote }}
           command: ["/bin/sh", "-c"]
@@ -74,23 +79,43 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_NAME
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: secret
+                  {{- end }}
             - name: API_JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: secret
+                  {{- end }}
           {{- with .Values.realtime.livenessProbe }}
           livenessProbe:
             {{- toYaml . | nindent 12 }}
diff --git a/charts/supabase/templates/rest/deployment.yaml b/charts/supabase/templates/rest/deployment.yaml
index 226527ba9257f4e5d21a59a313f5a6dbeedc476c..e877fa6f3e7111fb8e6d22b2b89129b94fb75730 100644
--- a/charts/supabase/templates/rest/deployment.yaml
+++ b/charts/supabase/templates/rest/deployment.yaml
@@ -46,30 +46,55 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_PASSWORD_ENC
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password_encoded
+                  {{- end }}
             - name: DB_NAME
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: PGRST_DB_URI
               value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@$(DB_HOST):$(DB_PORT)/$(DB_NAME)?sslmode=$(DB_SSL)
             - name: PGRST_JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: secret
-            - name: JWT_EXPIRY
+                  {{- end }}
+            - name: PGRST_APP_SETTINGS_JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
-                  key: expiry
+                  key: secret
+                  {{- end }}
           {{- with .Values.rest.livenessProbe }}
           livenessProbe:
             {{- toYaml . | nindent 12 }}
diff --git a/charts/supabase/templates/secrets/_helpers.tpl b/charts/supabase/templates/secrets/_helpers.tpl
index 1b167a8ca7100ba45d3a04a9e1c6223468b8f681..61d74eccbcd042fb926efbd809382893daa8841c 100644
--- a/charts/supabase/templates/secrets/_helpers.tpl
+++ b/charts/supabase/templates/secrets/_helpers.tpl
@@ -39,3 +39,19 @@ Expand the name of the s3 secret.
 {{- define "supabase.secret.s3" -}}
 {{- printf "%s-s3" (include "supabase.fullname" .) }}
 {{- end -}}
+
+{{/*
+Check if both s3 keys are valid
+*/}}
+{{- define "supabase.secret.s3.isValid" -}}
+{{- $isValid := "false" -}}
+{{- if .Values.secret.s3.keyId -}}
+{{- if .Values.secret.s3.accessKey -}}
+{{- printf "true" -}}
+{{- else -}}
+{{- printf "false" -}}
+{{- end -}}
+{{- else -}}
+{{- printf "false" -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/supabase/templates/secrets/analytics.yaml b/charts/supabase/templates/secrets/analytics.yaml
index 83e7b42090fe5c693d89dc16facb6c15f7ba01c4..b80f4f7431eca73a095df736ad2cbbcbff6b5b2c 100644
--- a/charts/supabase/templates/secrets/analytics.yaml
+++ b/charts/supabase/templates/secrets/analytics.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.secret.analytics }}
+{{- if not .Values.secret.analytics.secretRef }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +8,10 @@ metadata:
 type: Opaque
 data:
 {{- range $key, $value := .Values.secret.analytics }}
+{{- if $value }}
+{{- if eq (typeOf $value) "string" }}
   {{ $key }}: {{ $value | b64enc }}
 {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/secrets/dashboard.yaml b/charts/supabase/templates/secrets/dashboard.yaml
index f81ef57b3cbe3f5390a8418b7a6a417f6a553343..cd99197bd5c18d0c7018d6193981c3ad0bb5e8a0 100644
--- a/charts/supabase/templates/secrets/dashboard.yaml
+++ b/charts/supabase/templates/secrets/dashboard.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.secret.dashboard }}
+{{- if not .Values.secret.dashboard.secretRef }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,11 @@ metadata:
 type: Opaque
 data:
 {{- range $key, $value := .Values.secret.dashboard }}
+{{- if $value }}
+{{- if eq (typeOf $value) "string" }}
   {{ $key }}: {{ $value | b64enc }}
 {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/secrets/db.yaml b/charts/supabase/templates/secrets/db.yaml
index 1a6a26e0ec25bc67e07bf9c9165d0361bcaf3823..8cd97915ccf4bf60c29a442b19f8b1568066b2c5 100644
--- a/charts/supabase/templates/secrets/db.yaml
+++ b/charts/supabase/templates/secrets/db.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.secret.db.secretRef }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -7,6 +8,11 @@ metadata:
 type: Opaque
 data:
 {{- range $key, $value := .Values.secret.db }}
+{{- if $value }}
+{{- if or (eq (typeOf $value) "string") (eq (typeOf $value) "numeric") }}
   {{ $key }}: {{ $value | b64enc }}
+{{- end }}
+{{- end }}
 {{- end }}
   password_encoded: {{ .Values.secret.db.password | urlquery | b64enc }}
+{{- end }}
diff --git a/charts/supabase/templates/secrets/jwt.yaml b/charts/supabase/templates/secrets/jwt.yaml
index 5622d23243bc42a3536a95f236728f215793076a..0b190a1cc03b60ac5768b90754859eb5f2d7644f 100644
--- a/charts/supabase/templates/secrets/jwt.yaml
+++ b/charts/supabase/templates/secrets/jwt.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.secret.jwt }}
+{{- if not .Values.secret.jwt.secretRef }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,11 @@ metadata:
 type: Opaque
 data:
 {{- range $key, $value := .Values.secret.jwt }}
+{{- if $value }}
+{{- if eq (typeOf $value) "string" }}
   {{ $key }}: {{ $value | toString | b64enc }}
 {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/secrets/s3.yaml b/charts/supabase/templates/secrets/s3.yaml
index 1752e65812036aebba7e0ead11a27aaf8979c6a8..7421da428b53b564846361af3b4ba8da2f45861a 100644
--- a/charts/supabase/templates/secrets/s3.yaml
+++ b/charts/supabase/templates/secrets/s3.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.secret.s3 }}
+{{- if not .Values.secret.s3.secretRef }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,11 @@ metadata:
 type: Opaque
 data:
 {{- range $key, $value := .Values.secret.s3 }}
+{{- if $value }}
+{{- if eq (typeOf $value) "string" }}
   {{ $key }}: {{ $value | toString | b64enc }}
 {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/secrets/smtp.yaml b/charts/supabase/templates/secrets/smtp.yaml
index 38b70b70878b6180df9ce993fb3876d7a27c5608..05c3579b80b02978b0413fa16590d176f1cae4c0 100644
--- a/charts/supabase/templates/secrets/smtp.yaml
+++ b/charts/supabase/templates/secrets/smtp.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.secret.smtp }}
+{{- if not .Values.secret.smtp.secretRef }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,11 @@ metadata:
 type: Opaque
 data:
 {{- range $key, $value := .Values.secret.smtp }}
+{{- if $value }}
+{{- if eq (typeOf $value) "string" }}
   {{ $key }}: {{ $value | b64enc }}
 {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/storage/deployment.yaml b/charts/supabase/templates/storage/deployment.yaml
index 5fe6d5d134e18bf9e7ff146f3fff1c6b34944c8f..b0454297f999ffc70419c6f08bf4197e9a2bc438 100644
--- a/charts/supabase/templates/storage/deployment.yaml
+++ b/charts/supabase/templates/storage/deployment.yaml
@@ -43,8 +43,13 @@ spec:
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: username
+                  {{- end }}
             - name: DB_PORT
               value: {{ .Values.analytics.environment.DB_PORT | quote }}
           command: ["/bin/sh", "-c"]
@@ -102,50 +107,90 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password
+                  {{- end }}
             - name: DB_PASSWORD_ENC
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.password | default "password" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: password_encoded
+                  {{- end }}
             - name: DB_NAME
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.database | default "database" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: database
+                  {{- end }}
             - name: DATABASE_URL
               value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@$(DB_HOST):$(DB_PORT)/$(DB_NAME)?search_path=auth&sslmode=$(DB_SSL)
             - name: PGRST_JWT_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.secret | default "secret" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: secret
+                  {{- end }}
             - name: ANON_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.anonKey | default "anonKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: anonKey
+                  {{- end }}
             - name: SERVICE_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.serviceKey | default "serviceKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: serviceKey
+                  {{- end }}
             {{- if .Values.imgproxy.enabled }}
             - name: IMGPROXY_URL
               value: http://{{ include "supabase.imgproxy.fullname" . }}:{{ .Values.imgproxy.service.port | int }}
             {{- end }}
-            {{- if .Values.secret.s3 }}
+            {{- if eq (include "supabase.secret.s3.isValid" .) "true" }}
             - name: AWS_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
+                {{- if .Values.secret.s3.secretRef }}
+                  name: {{ .Values.secret.s3.secretRef }}
+                  key: {{ .Values.secret.s3.secretRefKey.keyId | default "keyId" }}
+                {{- else }}
                   name: {{ include "supabase.secret.s3" . }}
                   key: keyId
+                {{- end }}
             - name: AWS_SECRET_ACCESS_KEY
               valueFrom:
                 secretKeyRef:
+                {{- if .Values.secret.s3.secretRef }}
+                  name: {{ .Values.secret.s3.secretRef }}
+                  key: {{ .Values.secret.s3.secretRefKey.keyId | default "accessKey" }}
+                {{- else }}
                   name: {{ include "supabase.secret.s3" . }}
                   key: accessKey
+                {{- end }}
             {{- end }}
             {{- if .Values.minio.enabled }}
             - name: GLOBAL_S3_ENDPOINT
diff --git a/charts/supabase/templates/studio/deployment.yaml b/charts/supabase/templates/studio/deployment.yaml
index 2d4ddc7daab6bebd5efa5e488d0d755af7b4d8fa..dc4d9f8466a1490f9fea3ff5bf885c85777395aa 100644
--- a/charts/supabase/templates/studio/deployment.yaml
+++ b/charts/supabase/templates/studio/deployment.yaml
@@ -50,13 +50,23 @@ spec:
             - name: SUPABASE_ANON_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.anonKey | default "anonKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: anonKey
+                  {{- end }}
             - name: SUPABASE_SERVICE_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.jwt.secretRef }}
+                  name: {{ .Values.secret.jwt.secretRef }}
+                  key: {{ .Values.secret.jwt.secretRefKey.serviceKey | default "serviceKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.jwt" . }}
                   key: serviceKey
+                  {{- end }}
             {{- if .Values.analytics.enabled }}
             - name: LOGFLARE_URL
               value: http://{{ include "supabase.analytics.fullname" . }}:{{ .Values.analytics.service.port }}
diff --git a/charts/supabase/templates/test/db.yaml b/charts/supabase/templates/test/db.yaml
index 4863f7a698298465513dd9327e957f5e8a0f4ebb..296bcc3bb77ce5169c35901dea5e69f02a5a6ae2 100644
--- a/charts/supabase/templates/test/db.yaml
+++ b/charts/supabase/templates/test/db.yaml
@@ -28,8 +28,13 @@ spec:
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.db.secretRef }}
+                  name: {{ .Values.secret.db.secretRef }}
+                  key: {{ .Values.secret.db.secretRefKey.username | default "username" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.db" . }}
                   key: username
+                  {{- end }}
             - name: DB_PORT
               value: {{ .Values.auth.environment.DB_PORT | quote }}
           image: postgres:15-alpine
diff --git a/charts/supabase/templates/test/secretrefs.yaml b/charts/supabase/templates/test/secretrefs.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..51245ac51859f6e4d0cf863b310a792d0290a0e2
--- /dev/null
+++ b/charts/supabase/templates/test/secretrefs.yaml
@@ -0,0 +1,79 @@
+{{- if .Values.debug }}
+{{- if .Values.debug.secretRef }}
+{{- if .Values.secret.jwt.secretRef }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.jwt.secretRef }}
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install
+type: Opaque
+data:
+  anonKey: ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5QWdDaUFnSUNBaWNtOXNaU0k2SUNKaGJtOXVJaXdLSUNBZ0lDSnBjM01pT2lBaWMzVndZV0poYzJVdFpHVnRieUlzQ2lBZ0lDQWlhV0YwSWpvZ01UWTBNVGMyT1RJd01Dd0tJQ0FnSUNKbGVIQWlPaUF4TnprNU5UTTFOakF3Q24wLmRjX1g1aVJfVlBfcVQwenNpeWpfSV9PWjJUOUZ0UlUyQkJOV044QnU0R0U=
+  serviceKey: ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5QWdDaUFnSUNBaWNtOXNaU0k2SUNKelpYSjJhV05sWDNKdmJHVWlMQW9nSUNBZ0ltbHpjeUk2SUNKemRYQmhZbUZ6WlMxa1pXMXZJaXdLSUNBZ0lDSnBZWFFpT2lBeE5qUXhOelk1TWpBd0xBb2dJQ0FnSW1WNGNDSTZJREUzT1RrMU16VTJNREFLZlEuRGFZbE5Fb1VyckVuMklnN3RxaWJTLVBISzV2Z3VzYmNibzdYMzZYVnQ0UQ==
+  secret: eW91ci1zdXBlci1zZWNyZXQtand0LXRva2VuLXdpdGgtYXQtbGVhc3QtMzItY2hhcmFjdGVycy1sb25n
+{{- end }}
+{{- if .Values.secret.smtp.secretRef }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.smtp.secretRef }}
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install
+type: Opaque
+data:
+  username: eW91ci1tYWlsQGV4YW1wbGUuY29t
+  password: ZXhhbXBsZTEyMzQ1Ng==
+{{- end }}
+{{- if .Values.secret.dashboard.secretRef }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.dashboard.secretRef }}
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install
+type: Opaque
+data:
+  username: c3VwYWJhc2U=
+  password: dGhpc19wYXNzd29yZF9pc19pbnNlY3VyZV9hbmRfc2hvdWxkX2JlX3VwZGF0ZWQ=
+{{- end }}
+{{- if .Values.secret.db.secretRef }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.db.secretRef }}
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install
+type: Opaque
+data:
+  username: cG9zdGdyZXM=
+  password: ZXhhbXBsZTEyMzQ1Ng==
+  database: cG9zdGdyZXM=
+{{- end }}
+{{- if .Values.secret.analytics.secretRef }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.analytics.secretRef }}
+  labels:
+    {{- include "supabase.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-install
+type: Opaque
+data:
+  apiKey: eW91ci1zdXBlci1zZWNyZXQtYW5kLWxvbmctbG9nZmxhcmUta2V5
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/supabase/templates/vector/deployment.yaml b/charts/supabase/templates/vector/deployment.yaml
index 5dae5fd02824e9243a6291bbf0cbfbc15d7b99ba..911ff08d5b24ee4db1c8e09d637255af818989f3 100644
--- a/charts/supabase/templates/vector/deployment.yaml
+++ b/charts/supabase/templates/vector/deployment.yaml
@@ -52,8 +52,13 @@ spec:
             - name: LOGFLARE_API_KEY
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.secret.analytics.secretRef }}
+                  name: {{ .Values.secret.analytics.secretRef }}
+                  key: {{ .Values.secret.analytics.secretRefKey.apiKey | default "apiKey" }}
+                  {{- else }}
                   name: {{ include "supabase.secret.analytics" . }}
                   key: apiKey
+                  {{- end }}
           {{- end }}
           {{- with .Values.vector.livenessProbe }}
           livenessProbe:
diff --git a/charts/supabase/values.example.yaml b/charts/supabase/values.example.yaml
index 835c8b1673f7a60e55c643d8dbf79c8cdcb39ea4..c8f46e056b0afbaf4e3c8dde902c6ac5f72940a7 100644
--- a/charts/supabase/values.example.yaml
+++ b/charts/supabase/values.example.yaml
@@ -138,6 +138,9 @@ vector:
       path: /health
       port: 9001
     initialDelaySeconds: 3
+  ## Vector requires logs from the control plane to function.
+  ## This is normally stored in /var/log/pods
+  ## Modify these values according to your environment.
   volumeMounts:
     - name: pod-logs
       mountPath: /var/log/pods
diff --git a/charts/supabase/values.yaml b/charts/supabase/values.yaml
index d4dca75233715b973dc02deb807da97d11fd8fb6..62dbe13e3eb88cdbe359934293b319b1cd829090 100644
--- a/charts/supabase/values.yaml
+++ b/charts/supabase/values.yaml
@@ -21,29 +21,65 @@ secret:
     anonKey: ""
     serviceKey: ""
     secret: ""
-    expiry: 3600
+    # specify existing secret, which takes precedence over variables above
+    secretRef: ""
+    # override secret keys for existing secret refs
+    secretRefKey:
+      anonKey: anonKey
+      serviceKey: serviceKey
+      secret: secret
   # database credentials
   # these fields must be provided even if using external database
   db:
     username: ""
     password: ""
     database: ""
+    # specify existing secret, which takes precedence over variables above
+    secretRef: ""
+    # override secret keys for existing secret refs
+    secretRefKey:
+      username: username
+      password: password
+      database: database
   # analytics Logflare API key
   analytics:
     apiKey: ""
+    # specify existing secret, which takes precedence over variable above
+    secretRef: ""
+    # override secret keys for existing secret refs
+    secretRefKey:
+      apiKey: apiKey
   # smtp will be used to reference secret including smtp credentials
   smtp:
     # username: ""
     # password: ""
+    # specify existing secret, which takes precedence over variables above
+    # secretRef: ""
+    # override secret keys for existing secret refs
+    secretRefKey:
+      username: username
+      password: password
   # secret used to access the studio dashboard
   # leave it empty to disable dashboard authentication
   dashboard:
     # username: ""
     # password: ""
+    # specify existing secret, which takes precedence over variables above
+    # secretRef: ""
+    # override secret keys for existing secret refs
+    secretRefKey:
+      username: username
+      password: password
   # S3 credentials for storage object bucket
   s3:
     # keyId: ""
     # accessKey: ""
+    # specify existing secret, which takes precedence over variables above
+    # secretRef: ""
+    # override secret keys for existing secret refs
+    secretRefKey:
+      keyId: keyId
+      accessKey: accessKey
 
 # Optional: Postgres Database
 # A standalone Postgres database configured to work with Supabase services.
@@ -87,6 +123,7 @@ db:
     POSTGRES_HOST: /var/run/postgresql
     PGPORT: "5432"
     POSTGRES_PORT: "5432"
+    JWT_EXP: 3600
     # POSTGRES_HOST_AUTH_METHOD: md5
     # Enable SSL for postgres by specifying paths for mounted certificate key pair
     # POSTGRES_SSL_CERT: /path/to/ssl/server.crt
@@ -174,6 +211,8 @@ studio:
     STUDIO_PORT: "3000"
     SUPABASE_PUBLIC_URL: http://example.com
     NEXT_PUBLIC_ENABLE_LOGS: "true"
+    # Set value to bigquery to use Big Query backend for analytics
+    NEXT_ANALYTICS_BACKEND_PROVIDER: postgres  # postgres, bigquery
   # volumeMounts:
   #   - name: volume_name
   #     mountPath: /path/to/my/secret
@@ -348,6 +387,7 @@ rest:
     PGRST_DB_SCHEMAS: public,storage,graphql_public
     PGRST_DB_ANON_ROLE: anon
     PGRST_DB_USE_LEGACY_GUCS: false
+    PGRST_APP_SETTINGS_JWT_EXP: 3600
   # volumeMounts:
   #   - name: volume_name
   #     mountPath: /path/to/my/secret