diff --git a/fleet/lib/external-secrets-conf/fleet.yaml b/fleet/lib/external-secrets-conf/fleet.yaml
index d13222bb0..b78af65bf 100644
--- a/fleet/lib/external-secrets-conf/fleet.yaml
+++ b/fleet/lib/external-secrets-conf/fleet.yaml
@@ -12,6 +12,13 @@ dependsOn:
         bundle: external-secrets
 targetCustomizations:
   # first match is used
+  - name: ci
+    clusterSelector:
+      matchLabels:
+        ci: "true"
+    yaml:
+      overlays:
+        - ci
   - name: ayekan
     clusterName: ayekan
     yaml:
diff --git a/fleet/lib/external-secrets-conf/overlays/ci/clustersecretstore-onepassword.yaml b/fleet/lib/external-secrets-conf/overlays/ci/clustersecretstore-onepassword.yaml
new file mode 100644
index 000000000..b5b807e0d
--- /dev/null
+++ b/fleet/lib/external-secrets-conf/overlays/ci/clustersecretstore-onepassword.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: onepassword
+  namespace: external-secrets
+spec:
+  provider:
+    fake:
+      data:
+        - key: it-dns-dev (aws)
+          #property: username
+          value: XXXusername
+        - key: it-dns-dev (aws)
+          #property: password
+          value: XXXpassword