diff --git a/infra/k8s/databases/postgres.yaml b/infra/k8s/databases/postgres.yaml
index 5fdfd499a..bb291a929 100644
--- a/infra/k8s/databases/postgres.yaml
+++ b/infra/k8s/databases/postgres.yaml
@@ -52,8 +52,8 @@ spec:
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
           volumeMounts:
             - name: postgres-data
               mountPath: /var/lib/postgresql/data
diff --git a/infra/k8s/gitlab/postgres-init.yaml b/infra/k8s/gitlab/postgres-init.yaml
index e14bfee82..b54fccf7d 100644
--- a/infra/k8s/gitlab/postgres-init.yaml
+++ b/infra/k8s/gitlab/postgres-init.yaml
@@ -54,8 +54,8 @@ spec:
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: GITLAB_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
diff --git a/infra/k8s/jobs/migrate.yaml b/infra/k8s/jobs/migrate.yaml
index 881b0de9b..f1d7755d5 100644
--- a/infra/k8s/jobs/migrate.yaml
+++ b/infra/k8s/jobs/migrate.yaml
@@ -21,8 +21,8 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DB_PASSWORD)@postgres:5432/foxhunt"
           resources:
diff --git a/infra/k8s/secrets/foxhunt-secrets.yaml b/infra/k8s/secrets/foxhunt-secrets.yaml
index 9df45ecba..d5b167e36 100644
--- a/infra/k8s/secrets/foxhunt-secrets.yaml
+++ b/infra/k8s/secrets/foxhunt-secrets.yaml
@@ -1,19 +1,53 @@
+# Database credentials — used by services that connect to PostgreSQL.
+# Real values injected by scripts/deploy-secrets.sh from Scaleway Secrets Manager.
 apiVersion: v1
 kind: Secret
 metadata:
-  name: foxhunt-secrets
+  name: db-credentials
   namespace: foxhunt
   labels:
     app.kubernetes.io/part-of: foxhunt
 type: Opaque
 stringData:
-  # IMPORTANT: Replace these placeholder values before applying!
-  # Generate with: openssl rand -base64 32
-  db-password: "REPLACE_ME_WITH_REAL_PASSWORD"
-  jwt-secret: "REPLACE_ME_WITH_32_CHAR_MIN_SECRET_KEY"
-  redis-password: "REPLACE_ME_WITH_REAL_PASSWORD"
-  s3-access-key: "REPLACE_ME_WITH_S3_ACCESS_KEY"
-  s3-secret-key: "REPLACE_ME_WITH_S3_SECRET_KEY"
+  password: "REPLACE_IN_DEPLOY"
+---
+# JWT signing secret — used by services that validate/issue JWTs.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: jwt-secret
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+type: Opaque
+stringData:
+  secret: "REPLACE_IN_DEPLOY"
+---
+# Redis credentials — used by services with Redis connections.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-credentials
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+type: Opaque
+stringData:
+  password: "REPLACE_IN_DEPLOY"
+---
+# S3/Minio credentials for application-level access (model storage, data).
+# NOT the same as minio-credentials (used by initContainers for binary fetch).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+type: Opaque
+stringData:
+  access-key: "REPLACE_IN_DEPLOY"
+  secret-key: "REPLACE_IN_DEPLOY"
 ---
 # Registry pull secret for Scaleway Container Registry
 # Create with:
@@ -22,9 +56,3 @@ stringData:
 #     --docker-server=rg.fr-par.scw.cloud \
 #     --docker-username=foxhunt \
 #     --docker-password=<SCW_SECRET_KEY>
-#
-# This file documents the requirement but cannot contain the actual credentials.
-#
-# IBKR credentials are stored in a separate secret: ibkr-credentials
-# See infra/k8s/secrets/ibkr-credentials.yaml
-# Values are populated from Scaleway Secret Manager (foxhunt-ibkr-*) via CI/CD.
diff --git a/infra/k8s/services/api-gateway.yaml b/infra/k8s/services/api-gateway.yaml
index 1a82e2795..0c26ebe87 100644
--- a/infra/k8s/services/api-gateway.yaml
+++ b/infra/k8s/services/api-gateway.yaml
@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/backtesting-service.yaml b/infra/k8s/services/backtesting-service.yaml
index ce99bb616..21cdd0a3a 100644
--- a/infra/k8s/services/backtesting-service.yaml
+++ b/infra/k8s/services/backtesting-service.yaml
@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/broker-gateway.yaml b/infra/k8s/services/broker-gateway.yaml
index 4b326e919..347f42b95 100644
--- a/infra/k8s/services/broker-gateway.yaml
+++ b/infra/k8s/services/broker-gateway.yaml
@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/data-acquisition-service.yaml b/infra/k8s/services/data-acquisition-service.yaml
index e4b67b592..05036201f 100644
--- a/infra/k8s/services/data-acquisition-service.yaml
+++ b/infra/k8s/services/data-acquisition-service.yaml
@@ -112,8 +112,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
diff --git a/infra/k8s/services/ml-training-service-gpu.yaml b/infra/k8s/services/ml-training-service-gpu.yaml
index f3bfad58e..91843bb1a 100644
--- a/infra/k8s/services/ml-training-service-gpu.yaml
+++ b/infra/k8s/services/ml-training-service-gpu.yaml
@@ -118,8 +118,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -127,8 +127,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/ml-training-service.yaml b/infra/k8s/services/ml-training-service.yaml
index 957d47525..a88d54716 100644
--- a/infra/k8s/services/ml-training-service.yaml
+++ b/infra/k8s/services/ml-training-service.yaml
@@ -153,8 +153,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -162,8 +162,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/trading-agent-service.yaml b/infra/k8s/services/trading-agent-service.yaml
index e319da723..18c373b0e 100644
--- a/infra/k8s/services/trading-agent-service.yaml
+++ b/infra/k8s/services/trading-agent-service.yaml
@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/trading-service-gpu.yaml b/infra/k8s/services/trading-service-gpu.yaml
index 331c858e8..676d52029 100644
--- a/infra/k8s/services/trading-service-gpu.yaml
+++ b/infra/k8s/services/trading-service-gpu.yaml
@@ -117,8 +117,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -126,8 +126,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/trading-service.yaml b/infra/k8s/services/trading-service.yaml
index de2de320c..10b4c3ac5 100644
--- a/infra/k8s/services/trading-service.yaml
+++ b/infra/k8s/services/trading-service.yaml
@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE
diff --git a/infra/k8s/services/web-gateway.yaml b/infra/k8s/services/web-gateway.yaml
index 1959de8c9..bfda366ca 100644
--- a/infra/k8s/services/web-gateway.yaml
+++ b/infra/k8s/services/web-gateway.yaml
@@ -113,8 +113,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: TRADING_SERVICE_URL
               value: "http://api-gateway:50051"
             - name: BACKTESTING_SERVICE_URL