diff --git a/charts/agent-controller/Chart.yaml b/charts/agent-controller/Chart.yaml
index 3aedcab..129e651 100644
--- a/charts/agent-controller/Chart.yaml
+++ b/charts/agent-controller/Chart.yaml
@@ -9,7 +9,7 @@ description: >-
   one release. Install the community-components chart afterward to populate
   the catalog with Tool/Skill/Agent CRs.
 type: application
-version: 0.4.0
+version: 0.5.0
 appVersion: "0.1.0"
 home: https://github.com/imaustink/agent-controller
 sources:
@@ -44,7 +44,7 @@ dependencies:
   # picks its loop independently. Takes a Temporal address rather than bundling
   # a server, so it adds no stateful component.
   - name: temporal-engine
-    version: "0.1.1"
+    version: "0.2.0"
     repository: "file://charts/temporal-engine"
     condition: temporal-engine.enabled
   # GitHub Issues adapter (apps/integration-gateway) -- phase 1 of
diff --git a/charts/agent-controller/charts/temporal-engine/Chart.yaml b/charts/agent-controller/charts/temporal-engine/Chart.yaml
index fad74fa..b3451b1 100644
--- a/charts/agent-controller/charts/temporal-engine/Chart.yaml
+++ b/charts/agent-controller/charts/temporal-engine/Chart.yaml
@@ -7,7 +7,7 @@ description: >-
   in-process LangGraph loop serving every turn. Assumes a Temporal cluster is
   already reachable and takes its address, so this adds no stateful component.
 type: application
-version: 0.1.1
+version: 0.2.0
 appVersion: "0.1.0"
 home: https://github.com/imaustink/agent-controller
 sources:
diff --git a/charts/agent-controller/charts/temporal-engine/templates/gateway-deployment.yaml b/charts/agent-controller/charts/temporal-engine/templates/gateway-deployment.yaml
index ac6a82a..b58b703 100644
--- a/charts/agent-controller/charts/temporal-engine/templates/gateway-deployment.yaml
+++ b/charts/agent-controller/charts/temporal-engine/templates/gateway-deployment.yaml
@@ -39,9 +39,22 @@ spec:
             {{- include "temporal-engine.temporalEnv" . | nindent 12 }}
             - name: GATEWAY_ADDR
               value: ":8080"
-            {{- with .Values.gateway.identity.staticIdentities }}
+            {{/*
+            The identity map is keyed BY the bearer token, so a values file is
+            the wrong home for it: anything that carries values into version
+            control publishes every token in it. The Secret form holds the same
+            JSON under a key, and takes precedence — the same shape
+            agent-orchestrator already uses for its own identity map.
+            */}}
+            {{- if .Values.gateway.identity.staticIdentitiesExistingSecret }}
             - name: STATIC_IDENTITIES
-              value: {{ . | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gateway.identity.staticIdentitiesExistingSecret }}
+                  key: {{ .Values.gateway.identity.staticIdentitiesExistingSecretKey }}
+            {{- else if .Values.gateway.identity.staticIdentities }}
+            - name: STATIC_IDENTITIES
+              value: {{ .Values.gateway.identity.staticIdentities | quote }}
             {{- end }}
             {{- with .Values.gateway.identity.defaultSubject }}
             - name: AGENT_DEFAULT_SUBJECT
diff --git a/charts/agent-controller/charts/temporal-engine/values.yaml b/charts/agent-controller/charts/temporal-engine/values.yaml
index b981ef3..5e88945 100644
--- a/charts/agent-controller/charts/temporal-engine/values.yaml
+++ b/charts/agent-controller/charts/temporal-engine/values.yaml
@@ -113,7 +113,19 @@ gateway:
   # an optional fallback. All empty fails closed to zero capabilities.
   identity:
     # JSON: {"<token>": {"subject": "user:x", "roles": ["reader"]}}
+    #
+    # This map is keyed BY the bearer token, so setting it here puts live
+    # credentials in a values file. Prefer staticIdentitiesExistingSecret below
+    # for anything beyond a local experiment.
     staticIdentities: ""
+    # The same JSON, read from a Secret key instead. Takes precedence over
+    # staticIdentities above, and lets the tokens stay out of version control
+    # while the rest of the release config stays in it.
+    staticIdentitiesExistingSecret: ""
+    staticIdentitiesExistingSecretKey: AGENT_STATIC_IDENTITIES
+    # Identity for callers that present no token at all. A fallback, not a
+    # default for unknown tokens: an unrecognised token lands here too, so
+    # setting this means the gateway never denies on identity alone.
     defaultSubject: ""
     defaultRoles: ""
   resources: