diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index ccd2f06..ce4d53f 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -3336,19 +3336,29 @@ environments:
                 create_infra_secrets: true
                 create_infra_policies: true
                 create_infra_roles: true
-                create_app_policies: false
-                create_app_roles: false
-            applications: {}
+                create_app_policies: true
+                create_app_roles: true
+            applications:
+                s3-proxy:
+                    role_name: s3-proxy
+                    policy_name: s3-proxy
+                    service_account_names:
+                        - s3-proxy
+                    service_account_namespaces:
+                        - s3-proxy
+                    token_ttl: 24h
+                    read_paths:
+                        - s3-proxy/tls
             data:
                 infrastructure:
                     zitadel:
                         postgresql:
-                            enabled: ENC[AES256_GCM,data:tUiXY8k=,iv:k+kCNn0FzHAJPoQVNGqd0Y6IVeolzVKuB4EQBRWouZE=,tag:dvF8Fl+h63oysx9aJdnhHQ==,type:bool]
+                            enabled: ENC[AES256_GCM,data:kzBvarQ=,iv:PWUauBvSoPcBaT+xchn6mc9OkS/KSMA2RoaW4uL5P+I=,tag:T648Y+iT5IRTgwC1jTrI6Q==,type:bool]
                     camunda:
                         postgresql:
-                            enabled: ENC[AES256_GCM,data:vceGfUo=,iv:pAil/xNMzxPAPKXEN+My4sfdhG1XFEa3iHKuNaUzR28=,tag:HnSyvbXvwSDN5Y05qCQ4nA==,type:bool]
+                            enabled: ENC[AES256_GCM,data:m5+qYOI=,iv:dvXKNQwfFgssPrdkG8GF5iChxkd0RmINAJRMF3bwYS0=,tag:g/PUJHqx0D3fDqezN/kTLw==,type:bool]
                         keycloak_admin:
-                            enabled: ENC[AES256_GCM,data:uhB8K0U=,iv:vSPbA9KHUFJvMSXjPqcYxtWFmfdKfdhHCUhcNGW+h1A=,tag:OgSP6tW8Rv1FAinJTwdofg==,type:bool]
+                            enabled: ENC[AES256_GCM,data:78JPBOg=,iv:An+GwMbZeN1sO6PDr949q5HAMKw7Y/fE9+XcsoVr3Xg=,tag:mSyk06P4p4jzWzLWRsNCfA==,type:bool]
         secrets:
             - name: zitadel-postgresql
               namespace: zitadel
@@ -3427,8 +3437,8 @@ sops:
             U1hiSTkrMzRwMGpOeGtYNnNyNElYOE0KOHsFrj5+iMx8tIymrIhLpB8xbLaztR7J
             E+ViNs6OGeIS90qwxAD7OP9raGB/lsTfh9V/zigM8gF+OzGErF73aQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T08:57:48Z"
-    mac: ENC[AES256_GCM,data:+zLoBUSLIImG5iB7zHec622MtuPZcHjHcT9irLmA5QXBV8zVMjgQwbDICzDGJBhmFno9agSfASOCNfARdOSPrz8eWCZbw71moJ5JFf6tnT5z18VjdNz0l8/Bjv9TRF8VNsn56NcKTG/3HaC1gSLcoxNqRUqVLO6FbAoL1TZoV5Q=,iv:/MzcAma6lsp+Axj5OBWdMkf6QJ1GaWtDbE1UY0qwqhg=,tag:OrEMeoGAI4Ma9PFQrN72yg==,type:str]
+    lastmodified: "2026-08-26T09:13:25Z"
+    mac: ENC[AES256_GCM,data:N/nLRgqWXLh5ZXWlz4nWZn3n4dJGJJalSGyzRu8GXka54N1dJ99b/SEMJDTJWIF9eSQAGJ8tP9AKBlKhTZL8WueFrhxMkv7y+Z/ETXBbu1qj6XhPnzTZWubr1dtgG2biqldiyqPb510p4vHK6OUtmeKDy7/bz/meIVmvluRInbU=,iv:fI0uziHp1jfk0TEO+d6jAmFBZLl/IYEFrz6bIcBh4zc=,tag:9wNMM4A3C8LozhdqjFYrLA==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2