diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index c77d9fa4..c458e1dc 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -3,5 +3,5 @@ apiVersion: v2
 name: private-location
 description: Escape Private Location
 type: application
-version: 0.6.6
-appVersion: 0.6.6
+version: 0.6.7
+appVersion: 0.6.7
diff --git a/helm/templates/deploy.yaml b/helm/templates/deploy.yaml
index 836e0e95..f77414cf 100644
--- a/helm/templates/deploy.yaml
+++ b/helm/templates/deploy.yaml
@@ -45,7 +45,14 @@ spec:
             - name: HEALTH_CHECK_PORT
               value: '8080'
             - name: ESCAPE_API_KEY
+              {{- if .Values.existingSecret.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.existingSecret.name }}
+                  key: {{ .Values.existingSecret.key }}
+              {{- else }}
               value: {{ .Values.ESCAPE_API_KEY | default "" | quote }}
+              {{- end }}
             - name: ESCAPE_K8S_INTEGRATION
               value: {{ .Values.ESCAPE_K8S_INTEGRATION | quote }}
             - name: ESCAPE_ENABLE_LOGS_ENDPOINT
diff --git a/helm/values.yaml b/helm/values.yaml
index e66d858f..4505597a 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -1,6 +1,12 @@
 ---
 ESCAPE_API_KEY: "00000000-0000-0000-0000-000000000000"
 
+# Reference a pre-existing Kubernetes Secret to source ESCAPE_API_KEY.
+# When set, this takes precedence over the ESCAPE_API_KEY value above.
+existingSecret:
+  name: ""
+  key: ""
+
 # You can set the private location name here
 # or it will fallback to the helm release name
 ESCAPE_PRIVATE_LOCATION: ""