diff --git a/charts/stable/invidious/Chart.yaml b/charts/stable/invidious/Chart.yaml
index ac119fa2383..a996f1944d3 100644
--- a/charts/stable/invidious/Chart.yaml
+++ b/charts/stable/invidious/Chart.yaml
@@ -1,7 +1,7 @@
 kubeVersion: '>=1.24.0-0'
 apiVersion: v2
 name: invidious
-version: 7.0.12
+version: 7.0.13
 appVersion: latest
 description: Open source alternative front-end to YouTube.
 home: https://truecharts.org/charts/stable/invidious
diff --git a/charts/stable/invidious/questions.yaml b/charts/stable/invidious/questions.yaml
index f6029faee76..fcc2a35538c 100644
--- a/charts/stable/invidious/questions.yaml
+++ b/charts/stable/invidious/questions.yaml
@@ -346,13 +346,6 @@ questions:
                 schema:
                   type: boolean
                   default: false
-              - variable: hmac_key
-                label: HMAC Key
-                description: HMAC signing key used for CSRF tokens and pubsub subscriptions verification. A random key must be generated and placed here.
-                schema:
-                  type: string
-                  private: true
-                  default: ""
               - variable: dmca_content
                 label: DMCA Content
                 description: List of video IDs where the "download" widget must be disabled, in order to comply with DMCA requests.
diff --git a/charts/stable/invidious/templates/_config.tpl b/charts/stable/invidious/templates/_config.tpl
index c0867f71b49..05c49f3be47 100644
--- a/charts/stable/invidious/templates/_config.tpl
+++ b/charts/stable/invidious/templates/_config.tpl
@@ -1,5 +1,12 @@
 {{/* Define the configmap */}}
-{{- define "invidious.config" -}}
+{{- define "invidious.secret" -}}
+
+{{- $secretName := printf "%s-invidious-secret" (include "tc.v1.common.lib.chart.names.fullname" .) -}}
+
+{{- $hmac := randAlphaNum 64 -}}
+{{- with (lookup "v1" "Secret" .Release.Namespace $secretName) -}}
+  {{- $hmac = (index .data "HMAC_KEY") | b64dec -}}
+{{- end -}}
 
 {{- $vNet := .Values.invidious.network }}
 {{- $vLog := .Values.invidious.logging }}
@@ -17,6 +24,7 @@
 {{- $vUserMisc := .Values.invidious.default_user_preferences.miscellaneous }}
 enabled: true
 data:
+  HMAC_KEY: {{ $hmac }}
   INVIDIOUS_CONFIG: |
     # Database
     check_tables: true
@@ -85,7 +93,7 @@ data:
     # Miscellaneaous
     banner: {{ $vMisc.banner }}
     use_pubsub_feeds: {{ $vMisc.use_pubsub_feeds }}
-    hmac_key: {{ $vMisc.hmac_key }}
+    hmac_key: {{ $hmac }}
     {{- if $vMisc.dmca_content }}
     dmca_content:
       {{- range $vMisc.dmca_content }}
diff --git a/charts/stable/invidious/templates/common.yaml b/charts/stable/invidious/templates/common.yaml
index 572b59322e4..e349f5c1fb6 100644
--- a/charts/stable/invidious/templates/common.yaml
+++ b/charts/stable/invidious/templates/common.yaml
@@ -2,9 +2,9 @@
 {{- include "tc.v1.common.loader.init" . }}
 
 {{/* Render configmap for invidious */}}
-{{- $configmapFile := include "invidious.config" . | fromYaml -}}
-{{- if $configmapFile -}}
-  {{- $_ := set .Values.configmap "invidious-config" $configmapFile -}}
+{{- $secretFile := include "invidious.secret" . | fromYaml -}}
+{{- if $secretFile -}}
+  {{- $_ := set .Values.secret "invidious-secret" $secretFile -}}
 {{- end -}}
 
 {{/* Render the templates */}}
diff --git a/charts/stable/invidious/values.yaml b/charts/stable/invidious/values.yaml
index bc53115734b..3c5402cf449 100644
--- a/charts/stable/invidious/values.yaml
+++ b/charts/stable/invidious/values.yaml
@@ -64,8 +64,8 @@ workload:
             startup:
               type: http
           envFrom:
-            - configMapRef:
-                name: invidious-config
+            - secretRef:
+                name: invidious-secret
 invidious:
   network:
     inbound:
@@ -110,7 +110,6 @@ invidious:
   miscellaneous:
     banner: ""
     use_pubsub_feeds: false
-    hmac_key: ""
     dmca_content: []
     cache_annotations: false
     playlist_length_limit: 500