diff --git a/charts/rh-keycloak/templates/cleanup-keycloak-users.yaml b/charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml
similarity index 84%
rename from charts/rh-keycloak/templates/cleanup-keycloak-users.yaml
rename to charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml
index 4b2dda9d..7cb7b7bf 100644
--- a/charts/rh-keycloak/templates/cleanup-keycloak-users.yaml
+++ b/charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: cleanup-keycloak-users
+  name: cleanup-keycloak-setup
   namespace: {{ .Release.Namespace }}
   annotations:
     argocd.argoproj.io/hook: PostSync
@@ -12,7 +12,7 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: cleanup-keycloak-users
+  name: cleanup-keycloak-setup
   namespace: {{ .Release.Namespace }}
   annotations:
     argocd.argoproj.io/hook: PostSync
@@ -25,7 +25,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: cleanup-keycloak-users
+  name: cleanup-keycloak-setup
   namespace: {{ .Release.Namespace }}
   annotations:
     argocd.argoproj.io/hook: PostSync
@@ -33,16 +33,16 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: cleanup-keycloak-users
+  name: cleanup-keycloak-setup
 subjects:
 - kind: ServiceAccount
-  name: cleanup-keycloak-users
+  name: cleanup-keycloak-setup
   namespace: {{ .Release.Namespace }}
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: cleanup-keycloak-users
+  name: cleanup-keycloak-setup
   namespace: {{ .Release.Namespace }}
   annotations:
     argocd.argoproj.io/hook: PostSync
@@ -53,9 +53,9 @@ spec:
   template:
     metadata:
       labels:
-        app: cleanup-keycloak-users
+        app: cleanup-keycloak-setup
     spec:
-      serviceAccountName: cleanup-keycloak-users
+      serviceAccountName: cleanup-keycloak-setup
       restartPolicy: Never
       containers:
       - name: cleanup
diff --git a/charts/rh-keycloak/templates/cleanup-network-policy.yaml b/charts/rh-keycloak/templates/cleanup-network-policy.yaml
index 3b90e22c..a11bab9e 100644
--- a/charts/rh-keycloak/templates/cleanup-network-policy.yaml
+++ b/charts/rh-keycloak/templates/cleanup-network-policy.yaml
@@ -2,7 +2,7 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: cleanup-keycloak-users-netpol
+  name: cleanup-keycloak-setup-netpol
   namespace: {{ .Release.Namespace }}
   annotations:
     argocd.argoproj.io/hook: PostSync
@@ -10,7 +10,7 @@ metadata:
 spec:
   podSelector:
     matchLabels:
-      app: cleanup-keycloak-users
+      app: cleanup-keycloak-setup
   policyTypes:
   - Egress
   egress:
diff --git a/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml b/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml
index 8784a99d..9c714feb 100644
--- a/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml
+++ b/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   annotations:
     argocd.argoproj.io/sync-wave: "0"
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+    argocd.argoproj.io/sync-options: PrunePropagationPolicy=orphan
+  labels:
+    validatedpatterns.io/cleanup: delete
 type: Opaque
 stringData:
   client-id: "{{ include "rh-keycloak.qtodo.oidc.clientId" . }}"
diff --git a/charts/rh-keycloak/values.yaml b/charts/rh-keycloak/values.yaml
index dde918e5..84472353 100644
--- a/charts/rh-keycloak/values.yaml
+++ b/charts/rh-keycloak/values.yaml
@@ -574,6 +574,17 @@ rhbk:
 
       # ACS Central OIDC client secret
       - name: acs-oidc-client-secret
+        creationPolicy: "Orphan"
+        deletionPolicy: "Retain"
+        refreshPolicy: "OnChange"
+        metadata:
+          annotations:
+            argocd.argoproj.io/hook: Sync
+            argocd.argoproj.io/hook-delete-policy: HookSucceeded
+            argocd.argoproj.io/sync-options: PrunePropagationPolicy=orphan
+        targetMetadata:
+          labels:
+            validatedpatterns.io/cleanup: delete
         data:
           - secretKey: client_secret
             remoteRef:
@@ -584,6 +595,17 @@ rhbk:
 
       # RHTPA CLI OIDC client secret
       - name: rhtpa-oidc-cli-secret
+        creationPolicy: "Orphan"
+        deletionPolicy: "Retain"
+        refreshPolicy: "OnChange"
+        metadata:
+          annotations:
+            argocd.argoproj.io/hook: Sync
+            argocd.argoproj.io/hook-delete-policy: HookSucceeded
+            argocd.argoproj.io/sync-options: PrunePropagationPolicy=orphan
+        targetMetadata:
+          labels:
+            validatedpatterns.io/cleanup: delete
         data:
           - secretKey: client_secret
             remoteRef: