diff --git a/kubernetes/apps/observability/grafana/app/externalsecret.yaml b/kubernetes/apps/observability/grafana/app/externalsecret.yaml
index c3491d0b..dce3eb05 100644
--- a/kubernetes/apps/observability/grafana/app/externalsecret.yaml
+++ b/kubernetes/apps/observability/grafana/app/externalsecret.yaml
@@ -20,8 +20,8 @@ spec:
         GF_SERVER_ROOT_URL: https://grafana.hsn.dev
         GF_DATABASE_NAME: ${DB_NAME}
         GF_DATABASE_HOST: "grafana-primary.observability.svc:5432"
-        GF_DATABASE_USER: "{{ .grafana_postgres_user }}"
-        GF_DATABASE_PASSWORD: "{{ .grafana_postgres_password }}"
+        # GF_DATABASE_USER: "{{ .grafana_postgres_user }}"
+        # GF_DATABASE_PASSWORD: "{{ .grafana_postgres_password }}"
         GF_DATABASE_SSL_MODE: "require"
         GF_DATABASE_TYPE: postgres
         GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
diff --git a/kubernetes/apps/observability/grafana/app/helmrelease.yaml b/kubernetes/apps/observability/grafana/app/helmrelease.yaml
index 8b5248c7..cf85ba17 100644
--- a/kubernetes/apps/observability/grafana/app/helmrelease.yaml
+++ b/kubernetes/apps/observability/grafana/app/helmrelease.yaml
@@ -31,6 +31,17 @@ spec:
   values:
     replicas: 2
     envFromSecret: grafana-secret
+    env:
+      - name: GF_DATABASE_USER
+        valueFrom:
+          secretKeyRef:
+            name: grafana-pguser-grafana
+            key: user
+      - name: GF_DATABASE_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: grafana-pguser-grafana
+            key: password
     dashboardProviders:
       dashboardproviders.yaml:
         apiVersion: 1