diff --git a/fleet/lib/external-secrets-conf/fleet.yaml b/fleet/lib/external-secrets-conf/fleet.yaml
index d13222bb0..b78af65bf 100644
--- a/fleet/lib/external-secrets-conf/fleet.yaml
+++ b/fleet/lib/external-secrets-conf/fleet.yaml
@@ -12,6 +12,13 @@ dependsOn:
         bundle: external-secrets
 targetCustomizations:
   # first match is used
+  - name: ci
+    clusterSelector:
+      matchLabels:
+        ci: "true"
+    yaml:
+      overlays:
+        - ci
   - name: ayekan
     clusterName: ayekan
     yaml:
diff --git a/fleet/lib/external-secrets-conf/overlays/ci/clustersecretstore-onepassword.yaml b/fleet/lib/external-secrets-conf/overlays/ci/clustersecretstore-onepassword.yaml
new file mode 100644
index 000000000..094ed531b
--- /dev/null
+++ b/fleet/lib/external-secrets-conf/overlays/ci/clustersecretstore-onepassword.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: onepassword
+  namespace: external-secrets
+spec:
+  provider:
+    fake:
+      data:
+        - key: "/foo/bar"
+          value: "HELLO1"
+          version: "v1"
+        - key: "/foo/bar"
+          value: "HELLO2"
+          version: "v2"
+        - key: "/foo/baz"
+          value: '{"john": "doe"}'
+          version: "v1"