diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index 05292d5..b09352e 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -1782,6 +1782,42 @@ environments:
                         - postgresql/apps/subscriptions
                         - minio/apps/subscriptions
                         - apps/subscriptions/postgres
+                superset:
+                    enabled: true
+                    policy_name: superset
+                    role_name: superset
+                    service_account_names:
+                        - superset
+                    service_account_namespaces:
+                        - superset
+                    token_ttl: 24h
+                    secret_path: vault/apps/superset
+                    read_paths:
+                        - vault/apps/superset
+                        - apps/superset/postgres
+                    data:
+                        secret_data:
+                            SUPERSET_SECRET_KEY: ENC[AES256_GCM,data:dDLCYZg4BfvN7JtdNh4eP74XpHRiXU1BQ8t519ke2CYOOnub8+u4OIAiYnMpezWYVjsyepbT07o7MQovbqYkRw==,iv:HFRll27llotlwgPEry3v4Qt16Gq9d2M2apLi/Ti1GIU=,tag:svqVJk33b1TZ15YbRngenA==,type:str]
+                            JWT_SECRET: ENC[AES256_GCM,data:mqOSHyW+GacRowzkWdTKpQLZzU37XgkiNBHP7ZeUpUggtWb8dOdNQZj8hjFztEDa9lMZZwP5IB81oLroKOPLpA==,iv:ynT0v3nVHezSaGIjCcdX/95LtdT8f0wO7fhA4H8yUW0=,tag:Obh8KUkTNwe1jsMiNi/0hA==,type:str]
+                trino:
+                    enabled: true
+                    policy_name: trino
+                    role_name: trino
+                    service_account_names:
+                        - trino
+                    service_account_namespaces:
+                        - trino
+                    token_ttl: 24h
+                    secret_path: vault/apps/trino
+                    read_paths:
+                        - vault/apps/trino
+                    data:
+                        secret_data:
+                            TRINO_POSTGRES_HOST: ENC[AES256_GCM,data:3OEYNMxSSgbz9I4PbjQ=,iv:c+uKTyguu3XzNsLHjOO0VQ1y9bkRAiAuPsrzbZuaWXc=,tag:ABqVCqg7MNoyLGme7GRORQ==,type:str]
+                            TRINO_POSTGRES_PORT: ENC[AES256_GCM,data:qkRemA==,iv:ULTbdDEDIz4eo9ZPWxI8VFTAwHZmvJ477+MMTFxJwWg=,tag:+Bpvdz4csw9oCAaTZDabsQ==,type:str]
+                            TRINO_POSTGRES_USER: ENC[AES256_GCM,data:Ckt2299dwAg=,iv:XEPFcH9kCsfi9ZiXaf/wxNwQWZEU/QWcOUUMQ24QrNI=,tag:nLKqGFGC5WTDVPKH4nxkiQ==,type:str]
+                            TRINO_POSTGRES_PASSWORD: ENC[AES256_GCM,data:6UJhIdGlo2WbYdhEY1DHrLk+FuGyodhx9WmbEIKA1ohqVIA09JVZ+Q==,iv:d4qhdZUjc4KpfDoE6Hb96fzeECVkjiPsvwL/AZ3EE/c=,tag:hdLhH/wbRyj/7XViD20oVQ==,type:str]
+                            TRINO_INTERNAL_SHARED_SECRET: ENC[AES256_GCM,data:GRueBA1FSQCapqpKZgYQStwEEhDIUC7cWkf82z1lPGMxEAly1cc7NMXj3t1y7t1FJACq71vILduWTKy2kGHrjg==,iv:wQlkycsb28YY+xqJ1eNhdwUdnnGphvqZ15UjZEppC3w=,tag:XYUUQwU2QmstAhPZ+gcu1w==,type:str]
             data:
                 common:
                     regcred:
@@ -2556,6 +2592,14 @@ environments:
                 test-key: ENC[AES256_GCM,data:gBD6Oqn1VyHiK/T1RpVOXg7qpH/21glFbRcufO9ZobSh33SzVcSybg==,iv:0DA+sOoij+d7zaEvF2r7FtRXRwSI4Zq04oN9mFK48ss=,tag:HYtTbcj8FJHb/fRM4G9iOg==,type:str]
               lifecycle:
                 ignore_changes: false
+            - name: superset-postgres
+              type: database
+              sink: vault
+              vault_path: apps/superset/postgres
+              depends_on:
+                cluster: main
+                db: superset
+                user: superset
     brusnika-stage:
         vault:
             enabled: true
@@ -3300,8 +3344,8 @@ sops:
             MVF2aHBzODJ3V1Bzc2NNYUZES2tDREkKFxrOxUd3m5E2cu71SFj4vfQlZnHhDBA6
             qGdq1XZoX0EYazSiRzYk3pcxHnpqMD6t8pX/NZUEkmo54G2nRKnH5Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-12T12:44:30Z"
-    mac: ENC[AES256_GCM,data:sprOtmY+1vLac+i5fA9Cimv01EIibpigRjdZRk/JErUz1yq4ulu97CSwBCEQGWoXh4EnJxijARLHhCFSbFcJ+UKsDQfSxDrHF+g8Y3bV7+fFTXAKObQAXFip8EJxVB2gXSpLBv3qM77pBXeR3vevAtNH7fHNWk6jEL1NRXBmjHE=,iv:2F4bkNXX9uXEorXscvx1r99d9KiYCGQ/GUAjQveppTE=,tag:AmGDtV2NeWJ4pSnVLZ8Wkg==,type:str]
+    lastmodified: "2026-08-20T10:05:25Z"
+    mac: ENC[AES256_GCM,data:oZuJXEqIKfYQttp4u9Rre7MqPFnY7ckv1j5NSavnOfjCmQnCqIHQdAFIkpWH7OT1+D9ehpHxUCXsojkEwm0YSaC7hmwhHaer+If5QYqvbKqXjaQcrfynAgjM/m6VA0/9HlTLS60zAmhpOLE9ujAJMfzxnwk9ivwckZv9I/RvKR8=,iv:GZcmiX1NBwQipBYoM6kPJ+vdaLhEDrHZwDPJeyExyWA=,tag:gxmuKp4LoqfLyrK5AlL2hg==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2
diff --git a/infrastructure.yaml b/infrastructure.yaml
index 0ddffb5..b2e0337 100644
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@@ -19,11 +19,37 @@ environments:
         labels:
           project: contour
 
+      - name: superset
+        manage: false
+        image_pull_secret: true
+        labels:
+          project: contour
+
+      - name: trino
+        manage: false
+        image_pull_secret: true
+        labels:
+          project: contour
+
     postgresql:
       default_host: 10.222.255.162
       default_port: 5432
 
     databases:
+      - cluster_id: main
+        database:
+          name: superset
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: superset
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+          permissions:
+            - superset
+
       - cluster_id: main
         database:
           name: attachments_db