diff --git a/templates/application.yaml b/templates/application.yaml
index 2ba8469..204dfe3 100644
--- a/templates/application.yaml
+++ b/templates/application.yaml
@@ -12,8 +12,12 @@ spec:
   source:
     repoURL: {{ .source.repoURL }}
     targetRevision: {{ .source.targetRevision }}
+    {{- if .source.chart }}
+    chart: {{ .source.chart }}
+    {{- else }}
     path: {{ .source.path }}
-    {{- if or (and .source.helm .source.helm.parameters) (and .source.helm .source.helm.valueFiles) }}
+    {{- end }}
+    {{- if or (and .source.helm .source.helm.parameters) (and .source.helm .source.helm.valueFiles) (and .source.helm .source.helm.values) }}
     helm:
       {{- if .source.helm.parameters }}
       parameters:
@@ -23,6 +27,10 @@ spec:
       valueFiles:
         {{- toYaml .source.helm.valueFiles | nindent 8 }}
       {{- end }}
+      {{- if .source.helm.values }}
+      values: |
+        {{- .source.helm.values | nindent 8 }}
+      {{- end }}
     {{- end }}
   destination:
     server: {{ .destination.server }}
diff --git a/values.yaml b/values.yaml
index 5de5764..6783607 100644
--- a/values.yaml
+++ b/values.yaml
@@ -32,3 +32,41 @@ applications:
         selfHeal: true
       syncOptions:
         - CreateNamespace=true
+
+  # External Secrets Operator - installed straight from its official Helm
+  # repo (no git source needed). CRDs are installed by the chart itself.
+  - name: external-secrets
+    enabled: true
+    source:
+      repoURL: https://charts.external-secrets.io
+      chart: external-secrets
+      targetRevision: "2.10.0"
+      helm:
+        values: |
+          installCRDs: true
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: external-secrets
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true
+
+  # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
+  - name: openbao
+    enabled: true
+    source:
+      repoURL: https://git.smokyzone.de/SmokyZone/openbao-gitops.git
+      targetRevision: main
+      path: .
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: openbao
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true