diff --git a/dynk8s-provisioner/.gitignore b/dynk8s-provisioner/.gitignore
new file mode 100644
index 0000000..21b42cf
--- /dev/null
+++ b/dynk8s-provisioner/.gitignore
@@ -0,0 +1 @@
+wireguard-config
diff --git a/dynk8s-provisioner/kustomization.yaml b/dynk8s-provisioner/kustomization.yaml
index b1f225a..bb7cd30 100644
--- a/dynk8s-provisioner/kustomization.yaml
+++ b/dynk8s-provisioner/kustomization.yaml
@@ -11,14 +11,4 @@ resources:
 - rbac.yaml
 - dynk8s-provisioner.yaml
 - ingress.yaml
-
-secretGenerator:
-- name: wireguard-config-0
-  namespace: dynk8s
-  type: dynk8s.du5t1n.me/wireguard-config
-  files:
-  - wireguard-config
-  options:
-    disableNameSuffixHash: true
-    labels:
-      dynk8s.du5t1n.me/ec2-instance-id: ''
+- secrets.yaml
diff --git a/dynk8s-provisioner/secrets.yaml b/dynk8s-provisioner/secrets.yaml
new file mode 100644
index 0000000..4b99ad7
--- /dev/null
+++ b/dynk8s-provisioner/secrets.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard-config-0
+  namespace: dynk8s
+spec:
+  encryptedData:
+    wireguard-config: AgCRjcXhRNtDg/LSmDKFxbSunGGNBu6GrHGYIPG+DMXCbAIiRnnjxpeu/7Vh0WrYcHCHoLdm0NAr7M9G7S8aS8XUDZ7ANphGk56t8Mrrv9ZzOwHyCnxm3QM6q7RNus2+PgKJ/zNe8j5M1u4v3wGk1XzXPtYQ4dRp6op5X+ILGUu16Y2/hcfHEtW9IupqCKgteo1GAyHY4I86ldsTSIvEtcriVhXrEIYYRwYzEpR06y15dbz4qC86nTDp0RuhO+eU4hEzu/c80IJIjTz5CbDundSYRLqafZgs+LwL2fo5wnVyDy1KfP5X2o2mbZFz/5fhwj3M27/g+4KLh08NY5DJTMN1CFrHYGcWUbpIqWYCEJd8c40jRzzDVhcHA3WJjOd0KZv0oRfwmjbBlf0mMxDcJhG/h8tngQBs6aNEpq69RbABbL0bBkIQBokmib4bSfppHTBYNhzbdLwDQJD072qqNGKbDufHkcK4bBwuvmeE00EKxqFoqz++6EQMRkuNN7UtpFDKyDxElOMlo09KKGMUqz/JkFPb4YRJhF31+CskWmU1AVFge7Z5sVe5lMiDpoH62Zg5sxRSaHbdYvsS1vxsTfdG3rmhOAMxxYc+Kvt3u3eNkzEV3lUosorspZhBnEzyHHcap1QUd19vVarjv77g9Br7PATOl3SmuK58JqW2dyOiMQvjLNUAZ27q3uEZGAzRZ8yg5RoejFpueFJjSjTnV1UFdH/OseHXgvFd60syg/mviIA9IGzaxCjoZfxL1GlfjGDYsetnnIDCcQR8K915Qh0PfMdwHKsPBmmDGAxP7k/DHEM3tYC66SQAD4mpMH4Ri8jDD3ijpq8ud93CZX5S32rU0yrXIWCM4ByXks32HACCEOIdfHuGuys6FRQTCPFJuYlpwsVTSJKLjy59rTz5B6nLKxtaOuRULh8MrDR7KlhMiE7gl5waiIlYaiecVn/sNfu4q9UfgwGUntKIovmrwcBPjMRmLgs3IQH4p02G4OemPaByXkPD1JROk2epNkLMwH+IsUxAveGy/hCmrLa9fRaJWSlfuAQtqOihf34YBudsfqwr0UGLI8VsVe+p+tF+AYftUGDf1trJTI8TJUB/91CwrC6c61EFbQCJc90w+lL+oJueDZdGXzoYvkCsDpfFMA==
+  template:
+    metadata:
+      name: wireguard-config-0
+      namespace: dynk8s
+      labels:
+        app.kubernetes.io/part-of: dynk8s-provisioner
+        dynk8s.du5t1n.me/ec2-instance-id: ''
+    type: dynk8s.du5t1n.me/wireguard-config
diff --git a/dynk8s-provisioner/wireguard-config b/dynk8s-provisioner/wireguard-config
deleted file mode 100644
index 8436987..0000000
--- a/dynk8s-provisioner/wireguard-config
+++ /dev/null
@@ -1,10 +0,0 @@
-[Interface]
-Address = 172.30.0.178/28
-DNS = 172.30.0.1
-PrivateKey = gGieVWS8SUQxC7L0NKmHlpvBTANNNaucsm9K1ioHPXU=
-
-[Peer]
-PublicKey = 85BW2bagvhOZnvFD6gmjnT+uUj5NaF4z+YFBV/br9BA=
-PresharedKey = bZgUN82zDW7Q+558omOyRrZ0rw3bUohmIjEaxgtZCv8=
-Endpoint = vpn.pyrocufflink.net:19998
-AllowedIPs = 172.30.0.0/26, 172.30.0.160/28, 172.31.1.0/24