diff --git a/gitea/versions/28/deployment.yaml b/gitea/versions/28/deployment.yaml
index ceaadbb..7641e7c 100644
--- a/gitea/versions/28/deployment.yaml
+++ b/gitea/versions/28/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: "gitea/gitea:28.2.0"
+          image: "gitea/gitea:28.2.0-rootless"
           imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
diff --git a/openproject/versions/17/manifest.yaml b/openproject/versions/17/manifest.yaml
index 8d11263..c8fb4c2 100644
--- a/openproject/versions/17/manifest.yaml
+++ b/openproject/versions/17/manifest.yaml
@@ -17,6 +17,7 @@ defaultConfig:
     host: '{{ .apps.memcached.host }}'
     port: '{{ .apps.memcached.port }}'
 defaultSecrets:
+- key: secretKeyBase
 - key: dbPassword
 - key: adminPassword
 requiredSecrets:
diff --git a/openproject/versions/17/seeder-job.yaml b/openproject/versions/17/seeder-job.yaml
index e5602f9..bc81d2e 100644
--- a/openproject/versions/17/seeder-job.yaml
+++ b/openproject/versions/17/seeder-job.yaml
@@ -58,6 +58,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -102,6 +107,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
diff --git a/openproject/versions/17/web-deployment.yaml b/openproject/versions/17/web-deployment.yaml
index 8144015..d9a099d 100644
--- a/openproject/versions/17/web-deployment.yaml
+++ b/openproject/versions/17/web-deployment.yaml
@@ -126,6 +126,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
diff --git a/openproject/versions/17/worker-deployment.yaml b/openproject/versions/17/worker-deployment.yaml
index 0e02fe7..a60d3bb 100644
--- a/openproject/versions/17/worker-deployment.yaml
+++ b/openproject/versions/17/worker-deployment.yaml
@@ -129,7 +129,11 @@ spec:
             - bash
             - /app/docker/prod/worker
           env:
-            
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef: