diff --git a/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml b/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml
index 2ef9f22..52bce9c 100644
--- a/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml
+++ b/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml
@@ -1,13 +1,20 @@
 {{- $name := include "cloudhost-app.name" . -}}
 {{- $ns   := include "cloudhost-app.namespace" . -}}
 {{- $registryUrl := .Values.registry.url | default "localhost:30500" -}}
+{{- $existingSecret := lookup "v1" "Secret" $ns "registry-pull-secret" -}}
+{{- if not $existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: registry-pull-secret
   namespace: {{ $ns }}
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-10"
   labels:
-    {{- include "cloudhost-app.labels" . | nindent 4 }}
+    app.kubernetes.io/managed-by: cloudhost
 type: kubernetes.io/dockerconfigjson
 data:
   .dockerconfigjson: {{ printf `{"auths":{"%s":{"auth":""}}}` $registryUrl | b64enc | quote }}
+{{- end }}