diff --git a/hswaw/paperless/paperless.libsonnet b/hswaw/paperless/paperless.libsonnet
index c58ecae..dc9d5d9 100644
--- a/hswaw/paperless/paperless.libsonnet
+++ b/hswaw/paperless/paperless.libsonnet
@@ -26,6 +26,16 @@
         storageClassName: "waw-hdd-redundant-3",
     },
 
+    secretRefs:: {
+        redis_password: { secretKeyRef: { name: "paperless", key: "redis_password" } },
+        postgres_password: { secretKeyRef: { name: "paperless", key: "postgres_password" } },
+        secret_key: { secretKeyRef: { name: "paperless", key: "secret_key" } },
+        proxy: {
+            cookie_secret: { secretKeyRef: { name: "paperless-proxy", key: "cookie_secret" } },
+            oidc_secret: { secretKeyRef: { name: "paperless-proxy", key: "oidc_secret" } },
+        },
+    },
+
     local ns = kube.Namespace(cfg.namespace),
 
     redis: redis {
@@ -34,7 +44,7 @@
             storageClassName: cfg.storageClassName,
             appName: "paperless",
             image: "redis:6.0",
-            password: { secretKeyRef: { name: "paperless", key: "redis_password" } },
+            password: top.secretRefs.redis_password,
         },
     },
 
@@ -45,7 +55,7 @@
             database: "paperless",
             username: "paperless",
 
-            password: { secretKeyRef: { name: "paperless", key: "postgres_password" } },
+            password: top.secretRefs.postgres_password,
             storageClassName: cfg.storageClassName,
             storageSize: "20Gi",
 
@@ -90,14 +100,14 @@
                                 OAUTH2_PROXY_UPSTREAMS: "http://127.0.0.1:8000",
                                 OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8001",
 
-                                OAUTH2_PROXY_COOKIE_SECRET: { secretKeyRef: { name: "paperless-proxy", key: "cookie_secret" } },
+                                OAUTH2_PROXY_COOKIE_SECRET: top.secretRefs.proxy.cookie_secret,
 
                                 OAUTH2_PROXY_PROVIDER: "oidc",
                                 OAUTH2_PROXY_OIDC_ISSUER_URL: "https://sso.hackerspace.pl",
                                 OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true",
 
                                 OAUTH2_PROXY_CLIENT_ID: "b4859334-140b-432a-81f6-8f3e135e021a",
-                                OAUTH2_PROXY_CLIENT_SECRET: { secretKeyRef: { name: "paperless-proxy", key: "oidc_secret" } },
+                                OAUTH2_PROXY_CLIENT_SECRET: top.secretRefs.proxy.oidc_secret,
 
                                 OAUTH2_PROXY_EMAIL_DOMAINS: "*",
                                 OAUTH2_PROXY_ALLOWED_GROUPS: "zarzad,paperless-admin",
@@ -129,7 +139,7 @@
                                 PAPERLESS_PORT: "8000",
                                 PAPERLESS_URL: "https://%s" % [cfg.domain],
 
-                                PAPERLESS_SECRET_KEY: { secretKeyRef: { name: "paperless", key: "secret_key" } },
+                                PAPERLESS_SECRET_KEY: top.secretRefs.secret_key,
 
                                 A_REDIS_PASSWORD: top.redis.cfg.password,
                                 PAPERLESS_REDIS: "redis://:$(A_REDIS_PASSWORD)@redis:6379",