diff --git a/charts/incubator/funkwhale/Chart.yaml b/charts/incubator/funkwhale/Chart.yaml
index a4ccb1fb92a..e05a60da7b7 100644
--- a/charts/incubator/funkwhale/Chart.yaml
+++ b/charts/incubator/funkwhale/Chart.yaml
@@ -26,6 +26,6 @@ name: funkwhale
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/incubator/funkwhale
   - https://funkwhale.audio/
-  - https://hub.docker.com/r/thetarkus/funkwhale/
+  - https://hub.docker.com/r/funkwhale/funkwhale
 type: application
-version: 2.0.1
+version: 2.1.0
diff --git a/charts/incubator/funkwhale/templates/_secret.tpl b/charts/incubator/funkwhale/templates/_secret.tpl
new file mode 100644
index 00000000000..618074fddbb
--- /dev/null
+++ b/charts/incubator/funkwhale/templates/_secret.tpl
@@ -0,0 +1,21 @@
+{{/* Define the secret */}}
+{{- define "funkwhale.secret" -}}
+
+{{- $secretName := printf "%s-secret" (include "tc.common.names.fullname" .) -}}
+
+---
+
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{- with (lookup "v1" "Secret" .Release.Namespace $secretName) }}
+  DJANGO_SECRET_KEY: {{ (index .data "DJANGO_SECRET_KEY") }}
+  {{- else }}
+  DJANGO_SECRET_KEY: {{ randAlphaNum 32 | b64enc }}
+  {{- end }}
+{{- end -}}
diff --git a/charts/incubator/funkwhale/templates/common.yaml b/charts/incubator/funkwhale/templates/common.yaml
index cbf66c20818..066683a70af 100644
--- a/charts/incubator/funkwhale/templates/common.yaml
+++ b/charts/incubator/funkwhale/templates/common.yaml
@@ -1,2 +1,8 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.common.loader.init" . }}
+
+{{/* Render secret */}}
+{{- include "funkwhale.secret" . }}
+
 {{/* Render the templates */}}
-{{ include "tc.common.loader.all" . }}
+{{ include "tc.common.loader.apply" . }}
diff --git a/charts/incubator/funkwhale/values.yaml b/charts/incubator/funkwhale/values.yaml
index 10d2c9a8d0b..e26c0540b44 100644
--- a/charts/incubator/funkwhale/values.yaml
+++ b/charts/incubator/funkwhale/values.yaml
@@ -1,10 +1,32 @@
-env:
-  FUNKWHALE_HOSTNAME: yourdomain.funkwhale
-  NESTED_PROXY: "0"
 image:
   pullPolicy: IfNotPresent
   repository: tccr.io/truecharts/funkwhale
-  tag: latest@sha256:ec538fd47441c881b3f06bfffcd164b63779a805ec6d05439dbeb5e8eff52729
+  tag: 1.2.8@sha256:e12c15ebb65102637b507ca0a610bc4a372495fd58bd8a02f2b4d024eff2badd
+
+podSecurityContext:
+  runAsGroup: 0
+  runAsUser: 0
+
+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+env:
+  DJANGO_SECRET_KEY:
+    secretKeyRef:
+      name: '{{ printf "%s-secret" (include "tc.common.names.fullname" .) }}'
+      key: DJANGO_SECRET_KEY
+  FUNKWHALE_HOSTNAME: yourdomain.funkwhale
+  NESTED_PROXY: "0"
+
+service:
+  main:
+    ports:
+      main:
+        port: 10236
+        protocol: HTTP
+        targetPort: 5000
+
 persistence:
   data:
     enabled: true
@@ -13,19 +35,6 @@ persistence:
     enabled: true
     mountPath: /music
     readOnly: true
-podSecurityContext:
-  runAsGroup: 0
-  runAsUser: 0
-securityContext:
-  readOnlyRootFilesystem: false
-  runAsNonRoot: false
-service:
-  main:
-    ports:
-      main:
-        port: 3030
-        protocol: TCP
-        targetPort: 80
 
 portal:
   enabled: true