diff --git a/charts/plane-ce/Chart.yaml b/charts/plane-ce/Chart.yaml
index e8bc52b..eedd48e 100644
--- a/charts/plane-ce/Chart.yaml
+++ b/charts/plane-ce/Chart.yaml
@@ -5,7 +5,7 @@ description: Meet Plane. An open-source software development tool to manage issu
 
 type: application
 
-version: 1.7.0
+version: 1.8.0
 appVersion: "1.4.1"
 
 home: https://plane.so
diff --git a/charts/plane-ce/templates/extra-objects.yaml b/charts/plane-ce/templates/extra-objects.yaml
new file mode 100644
index 0000000..cde19d3
--- /dev/null
+++ b/charts/plane-ce/templates/extra-objects.yaml
@@ -0,0 +1,38 @@
+{{/*
+Arbitrary extra objects, supplied by the operator through values.
+
+The reason this exists: everything a Plane environment needs to STOP holding credentials --
+an ESO SecretStore, the ExternalSecrets that produce the Secrets this chart reads by name --
+is not part of this chart and never should be, but it also has nowhere else to live when the
+release is delivered by a GitOps tool that treats one directory as one unit. Without this,
+those objects need a second bundle purely to exist, and a second bundle is a second thing to
+order correctly.
+
+Rendered with toYaml and NOT tpl, deliberately. The objects people put here are usually
+ExternalSecrets whose `target.template` contains ESO's own {{ }} placeholders; tpl would try
+to evaluate those as Helm expressions and fail, or worse, silently resolve them to empty.
+Values are not templated by Helm, so writing them here passes them through untouched.
+
+Ordering: give an object the standard Helm hook annotations to have it applied before the
+workloads, which is what an ExternalSecret wants -- the chart's Secret references are
+optional: false, so a pod that starts before its Secret exists sits in
+CreateContainerConfigError until it appears.
+
+  extraObjects:
+    - apiVersion: external-secrets.io/v1
+      kind: SecretStore
+      metadata:
+        name: aws-secrets-manager
+        annotations:
+          helm.sh/hook: pre-install,pre-upgrade
+          helm.sh/hook-weight: "-10"
+          helm.sh/hook-delete-policy: before-hook-creation
+      spec: { ... }
+
+Namespace is left to the object: most callers want the release namespace, which is the
+default when it is omitted, and a few legitimately want another.
+*/}}
+{{- range .Values.extraObjects }}
+---
+{{ toYaml . }}
+{{- end }}
diff --git a/charts/plane-ce/values.yaml b/charts/plane-ce/values.yaml
index 9437f1a..677bede 100644
--- a/charts/plane-ce/values.yaml
+++ b/charts/plane-ce/values.yaml
@@ -347,3 +347,16 @@ env:
   default_cluster_domain: cluster.local
 
   api_key_rate_limit: "60/minute"
+
+# Arbitrary extra Kubernetes objects rendered as part of this release. Intended for the
+# things that let an environment hold no credentials -- an ESO SecretStore and the
+# ExternalSecrets producing the Secrets referenced by external_secrets.* above -- which
+# belong to the operator rather than to this chart, but have nowhere to live when a GitOps
+# tool treats one directory as one unit.
+#
+# Passed through verbatim (toYaml, not tpl) so that ESO's own {{ }} placeholders inside a
+# target.template survive. Add the standard Helm hook annotations to have an object applied
+# BEFORE the workloads; the Secret references in this chart are optional: false, so a pod
+# that starts before its Secret exists waits in CreateContainerConfigError until it appears.
+extraObjects: []
+