diff --git a/apps/overlays/hexm-0002/secrets.yaml b/apps/overlays/hexm-0002/secrets.yaml
new file mode 100644
index 0000000..c1b85eb
--- /dev/null
+++ b/apps/overlays/hexm-0002/secrets.yaml
@@ -0,0 +1,92 @@
+# ============================================================
+# Node-specific secrets for hexm-0002
+#
+# These MUST be encrypted with SOPS before committing to Git.
+# Encrypt:  sops --encrypt --in-place secrets.yaml
+# Decrypt:  sops --decrypt secrets.yaml | kubectl apply -f -
+#
+# Alternatively, create imperatively and skip committing this file:
+#   kubectl create secret generic global-env \
+#     --from-literal=SIGNALYTIC_NODE_ID=HEXM0002 \
+#     --from-literal=SIGNALYTIC_FACILITY_NAME="Facility Name Here" \
+#     -n epcare
+# ============================================================
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: global-env
+  namespace: epcare
+type: Opaque
+stringData:
+  SIGNALYTIC_NODE_ID: "HEXM0002"
+  SIGNALYTIC_FACILITY_NAME: "HOPE CLINIC LUKULI"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cals-env
+  namespace: epcare
+type: Opaque
+stringData:
+  CALS_REMOTE_HOST: "REPLACE_WITH_REMOTE_HOST"
+  CALS_REMOTE_PATH: /home/cals/logs/HEXM0001
+  CALS_REMOTE_USER: cals
+  CALS_SSH_KEY_PATH: /root/.ssh/id_ed25519
+  CALS_TZ: UTC
+  CALS_SCHEDULE: "*/2 * * * *"
+  CALS_OPTIONS: -avz --delete
+  CALS_RETENTION_DAYS: "30"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cals-ssh-key
+  namespace: epcare
+type: Opaque
+stringData:
+  id_ed25519: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    REPLACE_WITH_ACTUAL_PRIVATE_KEY_FOR_HEXM0001
+    -----END OPENSSH PRIVATE KEY-----
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: db-env
+  namespace: epcare
+type: Opaque
+stringData:
+  OMRS_DB_USER: "openmrs"
+  OMRS_DB_PASSWORD: "password"
+  MYSQL_DATABASE: openmrs
+  MYSQL_USER: openmrs
+  MYSQL_PASSWORD: "password"
+  MYSQL_ROOT_PASSWORD: "password"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend-env
+  namespace: epcare
+type: Opaque
+stringData:
+  OMRS_CONFIG_MODULE_WEB_ADMIN: "true"
+  OMRS_CONFIG_AUTO_UPDATE_DATABASE: "true"
+  OMRS_CONFIG_CREATE_TABLES: "false"
+  OMRS_CONFIG_CONNECTION_SERVER: db
+  OMRS_CONFIG_CONNECTION_DATABASE: openmrs
+  OMRS_CONFIG_CONNECTION_USERNAME: openmrs
+  OMRS_CONFIG_CONNECTION_PASSWORD: "openmrs"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: frontend-env
+  namespace: epcare
+type: Opaque
+stringData:
+  SPA_PATH: /openmrs/spa
+  API_URL: /openmrs
+  SPA_CONFIG_URLS: /openmrs/spa/config-core_demo.json
+  SPA_DEFAULT_LOCALE: ""