diff --git a/apps/api/k8s/base/deployment.yaml b/apps/api/k8s/base/deployment.yaml
index 1f10840..a5521e8 100644
--- a/apps/api/k8s/base/deployment.yaml
+++ b/apps/api/k8s/base/deployment.yaml
@@ -14,6 +14,8 @@ spec:
       labels:
         app: api
     spec:
+      imagePullSecrets:
+        - name: ghcr-pull-secret
       containers:
         - name: api
           image: ghcr.io/lazorgurl/homelab-api:latest
diff --git a/apps/api/k8s/base/ghcr-pull-secret-sealed.yaml b/apps/api/k8s/base/ghcr-pull-secret-sealed.yaml
new file mode 100644
index 0000000..0f044d6
--- /dev/null
+++ b/apps/api/k8s/base/ghcr-pull-secret-sealed.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: apps
+spec:
+  encryptedData:
+    .dockerconfigjson: AgB7twUw+WM+H96XJQlZNqTTY5uweBab7NfDuK/CEFJ7062A6+1U3ZRGRhA1QXJJBnITlRT6rNAlVmhGw4aEPWeGeBzutpBcOT2JytQY0NbVf1cpTIkNv8ca/oUQMKbTEbCZ6lBcX2NzJjkTQI/MrN+bH7yCfgWKJUFxy6h41go37RlBj+G3uso4wQ7mTEV6dNIPw/vFfHyygDK4XUmYV6tFfVkYC/wPBxUlQvQqjKFvCVcNm7cog9vJqdRmiRgwUqehzHnGIqiUH+0Da6kwxs3+Rw9blFB4PBSDSa0YVUVvAvW2QpE8ZvfoAbj79x7i2fl8gDO3176vTkzen1hZl5TtIk+Hr2GChFkiNslOXKgsJVuWISQtnaTA4j9aOE8kona7zzE6J7vTQOmnlVSGHDjY/TAHjnB7qsodl6Vma6FLShcbG75E2+iAhJzxgbu2gLMcLFD8CuHNSur5rfnnhDeYhedQIyf4qcocXgL0yO+/NTv2hH76cfFPsn2dAwwwL6iVJWvFgA7pywAD0jr8r7PMLRZjQrJxOu1vqgXPMo2656A7yD9Mk87Z8W0g7LgP9XKITxwIW5B47kEdOkifwP/doazgsHs153eZSmbN8oVXXM4EGrAPMOJs+MVt9/pBcKA8Ct5QuCHpSKBZVWVOVbT1r2jFY+b7jHWb2zg93WYP8kU+ZN8a1D52h0zKgb9nTBn6qaDK2gSRCj0CSl11JVUynVAA60ZSHalQriZV2+ZAo1SHx4/uMhOpnJVU9mY9sIbXrMCJTGtWgyOlAg1UpdOefCJyfxEihm+n82Xp12fqmKjiptXgQX5YHF9stpo3VKOPpxfk6kfMIRh9ckuD3JXS3xJZV/7t/dSHXc0NsZxp/FTbP31pAcgWXS4s9qF681IyjXx3IGnxcyd16ADtXCvVfjDCZZceNWatxb7SABQg2F7h
+  template:
+    metadata:
+      name: ghcr-pull-secret
+      namespace: apps
+    type: kubernetes.io/dockerconfigjson
diff --git a/apps/api/k8s/base/kustomization.yaml b/apps/api/k8s/base/kustomization.yaml
index 94bdff3..bd998d0 100644
--- a/apps/api/k8s/base/kustomization.yaml
+++ b/apps/api/k8s/base/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - ghcr-pull-secret-sealed.yaml
diff --git a/apps/web/k8s/base/deployment.yaml b/apps/web/k8s/base/deployment.yaml
index 4121964..71f60f4 100644
--- a/apps/web/k8s/base/deployment.yaml
+++ b/apps/web/k8s/base/deployment.yaml
@@ -14,6 +14,8 @@ spec:
       labels:
         app: web
     spec:
+      imagePullSecrets:
+        - name: ghcr-pull-secret
       containers:
         - name: web
           image: ghcr.io/lazorgurl/homelab-web:latest
diff --git a/apps/web/k8s/base/ghcr-pull-secret-sealed.yaml b/apps/web/k8s/base/ghcr-pull-secret-sealed.yaml
new file mode 100644
index 0000000..0f044d6
--- /dev/null
+++ b/apps/web/k8s/base/ghcr-pull-secret-sealed.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: apps
+spec:
+  encryptedData:
+    .dockerconfigjson: AgB7twUw+WM+H96XJQlZNqTTY5uweBab7NfDuK/CEFJ7062A6+1U3ZRGRhA1QXJJBnITlRT6rNAlVmhGw4aEPWeGeBzutpBcOT2JytQY0NbVf1cpTIkNv8ca/oUQMKbTEbCZ6lBcX2NzJjkTQI/MrN+bH7yCfgWKJUFxy6h41go37RlBj+G3uso4wQ7mTEV6dNIPw/vFfHyygDK4XUmYV6tFfVkYC/wPBxUlQvQqjKFvCVcNm7cog9vJqdRmiRgwUqehzHnGIqiUH+0Da6kwxs3+Rw9blFB4PBSDSa0YVUVvAvW2QpE8ZvfoAbj79x7i2fl8gDO3176vTkzen1hZl5TtIk+Hr2GChFkiNslOXKgsJVuWISQtnaTA4j9aOE8kona7zzE6J7vTQOmnlVSGHDjY/TAHjnB7qsodl6Vma6FLShcbG75E2+iAhJzxgbu2gLMcLFD8CuHNSur5rfnnhDeYhedQIyf4qcocXgL0yO+/NTv2hH76cfFPsn2dAwwwL6iVJWvFgA7pywAD0jr8r7PMLRZjQrJxOu1vqgXPMo2656A7yD9Mk87Z8W0g7LgP9XKITxwIW5B47kEdOkifwP/doazgsHs153eZSmbN8oVXXM4EGrAPMOJs+MVt9/pBcKA8Ct5QuCHpSKBZVWVOVbT1r2jFY+b7jHWb2zg93WYP8kU+ZN8a1D52h0zKgb9nTBn6qaDK2gSRCj0CSl11JVUynVAA60ZSHalQriZV2+ZAo1SHx4/uMhOpnJVU9mY9sIbXrMCJTGtWgyOlAg1UpdOefCJyfxEihm+n82Xp12fqmKjiptXgQX5YHF9stpo3VKOPpxfk6kfMIRh9ckuD3JXS3xJZV/7t/dSHXc0NsZxp/FTbP31pAcgWXS4s9qF681IyjXx3IGnxcyd16ADtXCvVfjDCZZceNWatxb7SABQg2F7h
+  template:
+    metadata:
+      name: ghcr-pull-secret
+      namespace: apps
+    type: kubernetes.io/dockerconfigjson
diff --git a/apps/web/k8s/base/kustomization.yaml b/apps/web/k8s/base/kustomization.yaml
index 94bdff3..bd998d0 100644
--- a/apps/web/k8s/base/kustomization.yaml
+++ b/apps/web/k8s/base/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - ghcr-pull-secret-sealed.yaml