diff --git a/kubernetes/secret.yaml b/kubernetes/secret.yaml
new file mode 100644
index 0000000..8395292
--- /dev/null
+++ b/kubernetes/secret.yaml
@@ -0,0 +1,16 @@
+# Populate MATTERMOST_WEBHOOK_URL before applying.
+# Retrieve from OpenBao:
+#   curl -X POST http://192.168.87.14:8085/request-approval \
+#     -H "Content-Type: application/json" \
+#     -d '{"secret_path":"secret/approval-required/mattermost","requester":"claude-code","reason":"k8s-version-tracker webhook"}'
+#
+# Then base64-encode the value:
+#   echo -n "https://chat.themosers.club/hooks/..." | base64
+apiVersion: v1
+kind: Secret
+metadata:
+  name: version-tracker-secrets
+  namespace: k8s-version-tracker
+type: Opaque
+data:
+  MATTERMOST_WEBHOOK_URL: REPLACE_WITH_BASE64_ENCODED_WEBHOOK_URL