diff --git a/secrets/htwg-1/ghcr-pull-secret.yaml b/secrets/htwg-1/ghcr-pull-secret.yaml
new file mode 100644
index 0000000..1173efa
--- /dev/null
+++ b/secrets/htwg-1/ghcr-pull-secret.yaml
@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret docker-registry ghcr-pull-secret \
+#     --docker-server=ghcr.io --docker-username=<user> --docker-password=<token> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    .dockerconfigjson: REPLACE_WITH_SEALED_VALUE
+  template:
+    type: kubernetes.io/dockerconfigjson
+    metadata:
+      name: ghcr-pull-secret
+      namespace: nowchess
diff --git a/secrets/htwg-1/kustomization.yaml b/secrets/htwg-1/kustomization.yaml
index d743079..0c6218a 100644
--- a/secrets/htwg-1/kustomization.yaml
+++ b/secrets/htwg-1/kustomization.yaml
@@ -1,12 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# Seal each secret with the htwg-1 cluster key before uncommenting:
-#   kubectl -n nowchess create secret generic <name> ... --dry-run=client -o yaml \
-#     | kubeseal --controller-namespace kube-system -o yaml > secrets/nowchess/htwg-1-prod/<name>.yaml
+# Seal each secret with the htwg-1 cluster key before use:
+#   kubectl -n <namespace> create secret generic <name> ... --dry-run=client -o yaml \
+#     | kubeseal --controller-name sealed-secrets --controller-namespace kube-system -o yaml > <file>
 resources:
-  - ../nowchess/htwg-1-prod/ghcr-pull-secret.yaml
-  - ../nowchess/htwg-1-prod/ncs-jwt-keys.yaml
-  - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml
-  - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml
-  - ../nowchess/htwg-1-prod/remotek6-certs.yaml
-  - ../postgres/credentials-htwg-1.yaml
+  - ghcr-pull-secret.yaml
+  - ncs-jwt-keys.yaml
+  - ncs-db-secrets.yaml
+  - ncs-internal-secret.yaml
+  - remotek6-certs.yaml
+  - postgres-credentials.yaml
diff --git a/secrets/htwg-1/ncs-db-secrets.yaml b/secrets/htwg-1/ncs-db-secrets.yaml
new file mode 100644
index 0000000..8cf9e94
--- /dev/null
+++ b/secrets/htwg-1/ncs-db-secrets.yaml
@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-db-secrets \
+#     --from-literal=ACCOUNT_DB_URL=... --from-literal=ACCOUNT_DB_PASSWORD=... \
+#     (add all other DB keys) \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-db-secrets
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-db-secrets
+      namespace: nowchess
diff --git a/secrets/htwg-1/ncs-internal-secret.yaml b/secrets/htwg-1/ncs-internal-secret.yaml
new file mode 100644
index 0000000..f47b83d
--- /dev/null
+++ b/secrets/htwg-1/ncs-internal-secret.yaml
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-internal-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-internal-secret
+      namespace: nowchess
diff --git a/secrets/htwg-1/ncs-jwt-keys.yaml b/secrets/htwg-1/ncs-jwt-keys.yaml
new file mode 100644
index 0000000..bd4c720
--- /dev/null
+++ b/secrets/htwg-1/ncs-jwt-keys.yaml
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-jwt-keys
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-jwt-keys
+      namespace: nowchess
diff --git a/secrets/htwg-1/remotek6-certs.yaml b/secrets/htwg-1/remotek6-certs.yaml
new file mode 100644
index 0000000..8090b7e
--- /dev/null
+++ b/secrets/htwg-1/remotek6-certs.yaml
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: remotek6-certs
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: remotek6-certs
+      namespace: nowchess