diff --git a/flake.nix b/flake.nix
index 0ee2160..4ad504c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,6 +21,9 @@
     btc = {
       url = "github:fort-nix/nix-bitcoin/release";
     };
+    charts = {
+      url = "github:nix-community/nixhelm";
+    };
     darwin = {
       url = "github:lnl7/nix-darwin/master";
       inputs.nixpkgs.follows = "nixunstable";
@@ -63,8 +66,12 @@
           pkgs = prev;
         })
       );
+      charts_overlay = (
+        _f: _p: { inherit (top) chartsMetadata; }
+      );
       overlays = [
         top.agenix.overlays.default
+        charts_overlay
         local_overlay
         packages_overlay
         top.nurpkgs.overlays.default
diff --git a/manifests/apply.sh b/manifests/apply.sh
index 6d0514d..fd0a82e 100755
--- a/manifests/apply.sh
+++ b/manifests/apply.sh
@@ -16,7 +16,6 @@ helm upgrade --install cnpg \
     -f values/cnpg.yaml \
     --wait
 sleep 5
-./tailscale/apply.sh
 kubectl apply -k .
 
 ./immich/apply.sh
diff --git a/manifests/secrets/operator-oauth.yaml b/manifests/secrets/operator-oauth.yaml
new file mode 100644
index 0000000..ad60558
--- /dev/null
+++ b/manifests/secrets/operator-oauth.yaml
@@ -0,0 +1,33 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: operator-oauth
+  namespace: tailscale
+spec:
+  target:
+    name: operator-oauth
+    deletionPolicy: Delete
+    template:
+      type: kubernetes.io/basic-auth
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: ffa188a4-63b2-4926-99f0-b33b0021a4f4
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: ffa188a4-63b2-4926-99f0-b33b0021a4f4
+        property: password
diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix
index ae73896..679f544 100644
--- a/modules/nixos/kubernetes.nix
+++ b/modules/nixos/kubernetes.nix
@@ -80,24 +80,23 @@ in
         enable = true;
         autoDeployCharts = {
           external-secrets = {
+            inherit (pkgs.chartsMetadata.external-secrets.external-secrets) repo version;
             enable = true;
             createNamespace = true;
-            #hash = "";
+            hash = pkgs.chartsMetadata.external-secrets.external-secrets.chartHash;
             name = "external-secrets";
-            repo = "https://charts.external-secrets.io/";
             targetNamespace = "external-secrets";
             values = {
               crds.create = true;
               includeCRDs = true;
             };
-            version = "0.17.0";
           };
           kyverno = {
+            inherit (pkgs.chartsMetadata.kyverno.kyverno) repo version;
             enable = true;
             createNamespace = true;
-            #hash = "";
+            hash = pkgs.chartsMetadata.kyverno.kyverno.chartHash;
             name = "kyverno";
-            repo = "https://kyverno.github.io/kyverno/";
             targetNamespace = "kyverno-system";
             values = {
               admissionController.replicas =  3;
@@ -106,7 +105,14 @@ in
               reportsController.replicas =  2;
               crds.install =  true;
             };
-            version = "3.4.4";
+          };
+          tailscale = {
+            inherit (pkgs.chartsMetadata.tailscale.tailscale-operator) repo version;
+            enable = true;
+            createNamespace = true;
+            hash = pkgs.chartsMetadata.tailscale.tailscale-operator.chartHash;
+            name = "tailscale-operator";
+            targetNamespace = "tailscale";
           };
         };
         extraFlags = [
@@ -124,6 +130,7 @@ in
           cert-manager.source = cert-manager;
           flux.source = flux;
           node-annotations.content = ../../manifests/nodes.yaml;
+          operator-oauth.content = ../../manifests/external-secrets/operator-oauth.yaml;
         };
         role = if cfg.agentOnly then "agent" else "server";
         serverAddr = lib.mkIf (config.networking.hostName != "isaiah") "https://isaiah.home:6443";