diff --git a/main.tf b/main.tf
index 7557870..a020804 100644
--- a/main.tf
+++ b/main.tf
@@ -84,13 +84,6 @@ provider "helm" {
 
 # --- Deployment --------------------------------------------------------------
 
-locals {
-  secret_overrides = {
-    "secrets.djangoSecretKey"  = var.django_secret_key
-    "secrets.postgresPassword" = var.postgres_password
-  }
-}
-
 resource "helm_release" "boday_website" {
   name             = "boday-it"
   chart            = "./charts/boday-it"
@@ -105,12 +98,21 @@ resource "helm_release" "boday_website" {
     value = var.app_version
   }
 
-  # Secrets nur setzen, wenn sie übergeben wurden
+  # Secrets nur setzen, wenn sie übergeben wurden (sonst gilt values.yaml).
+  # nonsensitive() gibt nur "gesetzt ja/nein" frei, nicht den Wert selbst.
   dynamic "set_sensitive" {
-    for_each = { for k, v in local.secret_overrides : k => v if v != "" }
+    for_each = nonsensitive(var.django_secret_key != "") ? ["secrets.djangoSecretKey"] : []
     content {
-      name  = set_sensitive.key
-      value = set_sensitive.value
+      name  = set_sensitive.value
+      value = var.django_secret_key
+    }
+  }
+
+  dynamic "set_sensitive" {
+    for_each = nonsensitive(var.postgres_password != "") ? ["secrets.postgresPassword"] : []
+    content {
+      name  = set_sensitive.value
+      value = var.postgres_password
     }
   }
 }