diff --git a/charts/tailscale-proxy/Chart.yaml b/charts/tailscale-proxy/Chart.yaml
index a87d9d7..a92ef36 100644
--- a/charts/tailscale-proxy/Chart.yaml
+++ b/charts/tailscale-proxy/Chart.yaml
@@ -2,5 +2,5 @@
 name: tailscale-proxy
 description: A Helm chart to run tailscale node
 type: application
-version: 0.0.1
-appVersion: "0.0.1"
+version: 0.0.2
+appVersion: "0.0.2"
diff --git a/charts/tailscale-proxy/templates/install.yaml b/charts/tailscale-proxy/templates/install.yaml
index f85f753..d1f5a7c 100644
--- a/charts/tailscale-proxy/templates/install.yaml
+++ b/charts/tailscale-proxy/templates/install.yaml
@@ -1,17 +1,3 @@
-# apiVersion: v1
-# kind: PersistentVolumeClaim
-# metadata:
-#   name: tailscale
-#   namespace: {{ .Release.Namespace }}
-#   annotations:
-#     helm.sh/resource-policy: keep
-# spec:
-#   accessModes:
-#     - ReadWriteOnce
-#   resources:
-#     requests:
-#       storage: 1Gi
----
 apiVersion: headscale.dodo.cloud/v1
 kind: HeadscaleUser
 metadata:
@@ -39,10 +25,6 @@
       labels:
         app: tailscale
     spec:
-      # volumes:
-      # - name: tailscale
-      #   persistentVolumeClaim:
-      #     claimName: tailscale
       containers:
       - name: tailscale
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
@@ -55,13 +37,6 @@
         env:
         - name: TS_KUBE_SECRET
           value: {{ .Values.preAuthKeySecret }}
-        # - name: TS_STATE_DIR
-        #   value: /tailscale-state
-        # - name: TS_AUTHKEY
-        #   valueFrom:
-        #     secretKeyRef:
-        #       name: {{ .Values.preAuthKeySecret }}
-        #       key: key
         - name: TS_HOSTNAME
           value: {{ .Values.hostname }}
         {{- if .Values.ipSubnet }}
@@ -70,30 +45,3 @@
         {{- end }}
         - name: TS_EXTRA_ARGS
           value: --login-server={{ .Values.loginServer }}
-        # volumeMounts:
-        # - name: tailscale
-        #   mountPath: /tailscale-state
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: secrets
-  namespace: {{ .Release.Namespace }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list", "patch", "update"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: secrets
-  namespace: {{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: default
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: Role
-  name: secrets
-  apiGroup: rbac.authorization.k8s.io
diff --git a/core/installer/values-tmpl/private-network.cue b/core/installer/values-tmpl/private-network.cue
index 653da67..c22e5fc 100644
--- a/core/installer/values-tmpl/private-network.cue
+++ b/core/installer/values-tmpl/private-network.cue
@@ -38,6 +38,12 @@
 	}
 
 	charts: {
+		"access-secrets": {
+			kind: "GitRepository"
+			address: "https://code.v1.dodo.cloud/helm-charts"
+			branch: "main"
+			path: "charts/access-secrets"
+		}
 		"ingress-nginx": {
 			kind: "GitRepository"
 			address: "https://code.v1.dodo.cloud/helm-charts"
@@ -61,6 +67,18 @@
 	_ingressPrivate: "\(global.id)-ingress-private"
 
 	helm: {
+		"access-secrets": {
+			chart: charts["access-secrets"]
+			values: {
+				serviceAccountName: "default"
+			}
+		}
+		"access-secrets-nginx": {
+			chart: charts["access-secrets"]
+			values: {
+				serviceAccountName: "\(global.id)-nginx-private"
+			}
+		}
 		"ingress-nginx": {
 			chart: charts["ingress-nginx"]
 			values: {