diff --git a/llamacppllmbasev3/Chart.yaml b/llamacppllmbasev3/Chart.yaml
index 9b7ea7a2..fd70c015 100644
--- a/llamacppllmbasev3/Chart.yaml
+++ b/llamacppllmbasev3/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: b9879
+appVersion: b10068
 description: Generic llama.cpp + llm-init base; the GGUF model is supplied at install time via env
 name: llamacppllmbasev3
 type: application
-version: 1.2.22
+version: 1.2.24
diff --git a/llamacppllmbasev3/OlaresManifest.yaml b/llamacppllmbasev3/OlaresManifest.yaml
index a0780479..d2428c27 100644
--- a/llamacppllmbasev3/OlaresManifest.yaml
+++ b/llamacppllmbasev3/OlaresManifest.yaml
@@ -7,7 +7,7 @@ metadata:
   description: "Generic llama.cpp engine base. Pick any GGUF model at install via env."
   appid: llamacppllmbasev3
   title: llama.cpp Engine Base
-  version: '1.2.22'
+  version: '1.2.24'
   categories:
     - AI
 sharedEntrances:
@@ -33,9 +33,11 @@ workloadReplicas:
   llminit: 1
 spec:
   onlyAdmin: true
-  versionName: 'b9879'
+  versionName: 'b10068'
   upgradeDescription: |
-    Drop accelerator mode `cpu` (GPU-only: `nvidia` / `nvidia-gb10`). Chart 1.2.22.
+    Bump llama.cpp image to server-cuda12-b10068.
+
+    Move HF_TOKEN into a Kubernetes Secret and inject via secretKeyRef (engine + llm-init). Chart 1.2.24.
   fullDescription: |
     **IMPORTANT NOTE**  
     This app is a template and cannot be used on its own. To use it, set the environment variables below to connect a specific model.
@@ -186,12 +188,12 @@ envs:
     required: false
     applyOnChange: true
     valueFrom:
-      envName: OLARES_USER_HUGGINGFACE_SERVICE
+      envName: OLARES_SYSTEM_HUGGINGFACE_SERVICE
   - envName: HF_TOKEN
     required: false
     applyOnChange: true
     valueFrom:
-      envName: OLARES_USER_HUGGINGFACE_TOKEN
+      envName: OLARES_SYSTEM_HUGGINGFACE_TOKEN
   - envName: LLAMACPP_CPU_REQUEST    # default: 200m
     required: true
     default: "200m"
diff --git a/llamacppllmbasev3/templates/llamacpp.yaml b/llamacppllmbasev3/templates/llamacpp.yaml
index edf2a461..bc6dd254 100644
--- a/llamacppllmbasev3/templates/llamacpp.yaml
+++ b/llamacppllmbasev3/templates/llamacpp.yaml
@@ -73,7 +73,7 @@ spec:
             defaultMode: 0555
       containers:
         - name: llamacpp
-          image: docker.io/beclab/ggml-org-llama.cpp:server-cuda12-b9879
+          image: docker.io/beclab/ggml-org-llama.cpp:server-cuda12-b10068
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "/llm-init/wrappers/llamacpp.sh"]
           env:
@@ -95,7 +95,10 @@ spec:
 {{- end }}
 {{- if $hfToken }}
             - name: HF_TOKEN
-              value: "{{ $hfToken }}"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-secrets
+                  key: HF_TOKEN
 {{- end }}
             - name: PYTHONUNBUFFERED
               value: "1"
diff --git a/llamacppllmbasev3/templates/llm-init.yaml b/llamacppllmbasev3/templates/llm-init.yaml
index 737da950..1c426188 100644
--- a/llamacppllmbasev3/templates/llm-init.yaml
+++ b/llamacppllmbasev3/templates/llm-init.yaml
@@ -126,7 +126,10 @@ spec:
 {{- end }}
 {{- if $hfToken }}
             - name: HF_TOKEN
-              value: "{{ $hfToken }}"
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-secrets
+                  key: HF_TOKEN
 {{- end }}
             - name: RUN_DIR
               value: /run/llm-init
diff --git a/llamacppllmbasev3/templates/secret.yaml b/llamacppllmbasev3/templates/secret.yaml
new file mode 100644
index 00000000..bcbfe26e
--- /dev/null
+++ b/llamacppllmbasev3/templates/secret.yaml
@@ -0,0 +1,15 @@
+{{- $oe := .Values.olaresEnv | default dict -}}
+{{- $hfToken := $oe.HF_TOKEN | default "" -}}
+{{- if $hfToken }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-secrets
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: llamacppllmbasev3
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+stringData:
+  HF_TOKEN: {{ $hfToken | quote }}
+{{- end }}