diff --git a/deploy/k8s/activity-core-llm-connect/externalsecret.yaml b/deploy/k8s/activity-core-llm-connect/externalsecret.yaml
new file mode 100644
index 0000000..ff0738c
--- /dev/null
+++ b/deploy/k8s/activity-core-llm-connect/externalsecret.yaml
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: llm-connect-provider-secrets
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: llm-connect
+    app.kubernetes.io/part-of: railiance-gitops
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: llm-connect-provider-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: OPENROUTER_API_KEY
+      remoteRef:
+        key: platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
+        property: OPENROUTER_API_KEY
diff --git a/deploy/k8s/activity-core-llm-connect/kustomization.yaml b/deploy/k8s/activity-core-llm-connect/kustomization.yaml
index 456af66..819ced8 100644
--- a/deploy/k8s/activity-core-llm-connect/kustomization.yaml
+++ b/deploy/k8s/activity-core-llm-connect/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - networkpolicy.yaml
+  - externalsecret.yaml