diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index 1526421..4193427 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -3380,8 +3380,6 @@ environments:
                 cluster: main
                 db: zitadel
                 user: zitadel
-              custom_keys:
-                password: password
               random_keys:
                 humanPassword:
                     length: 32
@@ -3395,24 +3393,27 @@ environments:
                 cluster: main
                 db: bitnami_keycloak
                 user: bn_keycloak
-              custom_keys:
-                password: password
+            - name: camunda-identity-db-staging
+              namespace: camunda
+              type: database
+              sink: vault
+              vault_path: camunda/_identity_db
+              depends_on:
+                cluster: main
+                db: identity
+                user: identity
             - id: camunda-postgresql
               schema: ""
               namespace: camunda
               ownership: managed
-              source:
-                kind: postgresql_user
-                ref:
-                    cluster: main
-                    database: identity
-                    user: identity
               targets:
                 - kind: vault
                   path: camunda/postgresql
-              custom_keys:
-                password: identity-password
               extra_fields:
+                identity-password:
+                    source:
+                        kind: secret_ref
+                        ref: vault://camunda/_identity_db#password
                 postgres-password:
                     source:
                         kind: secret_ref
@@ -3450,8 +3451,8 @@ sops:
             U1hiSTkrMzRwMGpOeGtYNnNyNElYOE0KOHsFrj5+iMx8tIymrIhLpB8xbLaztR7J
             E+ViNs6OGeIS90qwxAD7OP9raGB/lsTfh9V/zigM8gF+OzGErF73aQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:01Z"
-    mac: ENC[AES256_GCM,data:mmBK74iHgrltCFJI58K5Zz4CKXTpchig3Kby8M0XT1riFfC2Jw7yAUX4oKFDGn72ayQYonsN6b48BXFPvdF0LeZM7Bh9X7o9AKfJ134jerzHoOrBPOFfn5GJgI0562pzktYZ0R9F3LIf2OUGxQNnNS6ZkqpOvn4ejD3gxCoe8r8=,iv:COfSTrzs1wHoYxITuRt1SfTSTXKxOFPfDH0Xe3TZ23Y=,tag:IwxUsn8QTcgBhoVPrTXF+A==,type:str]
+    lastmodified: "2026-08-26T10:44:09Z"
+    mac: ENC[AES256_GCM,data:UgdOCjoUgKcF8o3B9VBmBjftt9JQs5i5wgId7StulorPuDcXvBClE36T0jM1kOZ8k0rK4zfm85H6JEnfGaNaRkffikZjC6QMKH8/5ltET7aIK8jCTyh/QFC70MPruT4UqzI6XS2Qx7iWtR9y78j1YlkrCE9lZPWZ+msyVzEE4+M=,iv:w0+gv1wyHhcjte3YYTyl3FpNEhYjuu6RMeCYwF0vTbs=,tag:fpAIAyXsbYBMAV2SJEDoKQ==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2