diff --git a/deployments/kubernetes/manifests/secrets.yaml b/deployments/kubernetes/manifests/secrets.yaml
index 469b2c3..1ddd1ed 100644
--- a/deployments/kubernetes/manifests/secrets.yaml
+++ b/deployments/kubernetes/manifests/secrets.yaml
@@ -1,45 +1,69 @@
 ---
+# Note: Secrets should be stored in Vault for production use
+# This file is for development/testing purposes only
+# For production, use the Vault integration in deployments/vault/
 apiVersion: v1
 kind: Secret
 metadata:
   name: telecom-secrets
   namespace: telecom-platform
+  annotations:
+    vault.hashicorp.com/agent-inject: "true"
+    vault.hashicorp.com/agent-inject-secret-database: "kv/data/telecom-platform/database"
+    vault.hashicorp.com/agent-inject-secret-redis: "kv/data/telecom-platform/redis"
+    vault.hashicorp.com/agent-inject-secret-jwt: "kv/data/telecom-platform/jwt"
+    vault.hashicorp.com/agent-inject-secret-encryption: "kv/data/telecom-platform/encryption"
+    vault.hashicorp.com/agent-inject-secret-payment: "kv/data/telecom-platform/payment"
 type: Opaque
 data:
-  DATABASE_PASSWORD: cGFzc3dvcmQxMjM=  # password123
-  REDIS_PASSWORD: ""
-  STRIPE_API_KEY: ""
-  STRIPE_WEBHOOK_SECRET: ""
-  ES2_API_KEY: ""
-  INFLUXDB_TOKEN: dGVsZWNvbS1zdXBlci1zZWNyZXQtYXV0aC10b2tlbg==  # telecom-super-secret-auth-token
+  # These should be replaced by Vault injection in production
+  DATABASE_PASSWORD: ""  # Will be injected from Vault
+  REDIS_PASSWORD: ""     # Will be injected from Vault
+  STRIPE_API_KEY: ""     # Will be injected from Vault
+  STRIPE_WEBHOOK_SECRET: ""  # Will be injected from Vault
+  ES2_API_KEY: ""        # Will be injected from Vault
+  INFLUXDB_TOKEN: ""     # Will be injected from Vault
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: postgres-secret
   namespace: telecom-platform
+  annotations:
+    vault.hashicorp.com/agent-inject: "true"
+    vault.hashicorp.com/agent-inject-secret-credentials: "database/creds/telecom-platform"
 type: Opaque
 data:
-  POSTGRES_PASSWORD: cGFzc3dvcmQxMjM=  # password123
+  # Will be injected from Vault database secrets engine
+  POSTGRES_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: grafana-secret
   namespace: telecom-monitoring
+  annotations:
+    vault.hashicorp.com/agent-inject: "true"
+    vault.hashicorp.com/agent-inject-secret-admin: "kv/data/telecom-platform/grafana"
 type: Opaque
 data:
-  GF_SECURITY_ADMIN_PASSWORD: YWRtaW4xMjM=  # admin123
+  # Will be injected from Vault
+  GF_SECURITY_ADMIN_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: influxdb-secret
   namespace: telecom-monitoring
+  annotations:
+    vault.hashicorp.com/agent-inject: "true"
+    vault.hashicorp.com/agent-inject-secret-config: "kv/data/telecom-platform/influxdb"
 type: Opaque
 data:
-  INFLUXDB_ADMIN_USER: YWRtaW4=  # admin
-  INFLUXDB_ADMIN_PASSWORD: cGFzc3dvcmQxMjM=  # password123
-  INFLUXDB_USER: dGVsZWNvbQ==  # telecom
-  INFLUXDB_PASSWORD: dGVsZWNvbXBhc3M=  # telecompass
-  INFLUXDB_ADMIN_TOKEN: dGVsZWNvbS1zdXBlci1zZWNyZXQtYXV0aC10b2tlbg==  # telecom-super-secret-auth-token
+  # Will be injected from Vault
+  INFLUXDB_ADMIN_USER: ""
+  INFLUXDB_ADMIN_PASSWORD: ""
+  INFLUXDB_USER: ""
+  INFLUXDB_PASSWORD: ""
+  INFLUXDB_ADMIN_TOKEN: ""
+