diff --git a/scripts/src/pikaoa-delivery-renderer.test.ts b/scripts/src/pikaoa-delivery-renderer.test.ts
index 2f158cd3..6e0ab0c9 100644
--- a/scripts/src/pikaoa-delivery-renderer.test.ts
+++ b/scripts/src/pikaoa-delivery-renderer.test.ts
@@ -163,12 +163,18 @@ describe("PikaOA development PaC renderer", () => {
       expect(initializer).toContain('argocd.argoproj.io/sync-wave: "-1"');
       expect(manifest).toContain("configMap:");
       expect(manifest).toContain("secretKeyRef:");
-      expect(manifest.match(/name: pikaoa-dev-runtime/gu)).toHaveLength(7);
+      expect(manifest.match(/name: pikaoa-dev-runtime/gu)).toHaveLength(11);
       expect(manifest).not.toContain("secretName:");
       expect(manifest.match(/name: DATABASE_URL/gu)).toHaveLength(3);
       expect(manifest.match(/key: DATABASE_URL/gu)).toHaveLength(3);
-      expect(manifest.match(/name: OA_ADMIN_TOKEN/gu)).toHaveLength(1);
-      expect(manifest.match(/key: OA_ADMIN_TOKEN/gu)).toHaveLength(1);
+      expect(manifest.match(/name: PIKAOA_SESSION_SECRET/gu)).toHaveLength(2);
+      expect(manifest.match(/key: PIKAOA_SESSION_SECRET/gu)).toHaveLength(2);
+      expect(manifest.match(/name: OA_ADMIN_TOKEN/gu)).toHaveLength(2);
+      expect(manifest.match(/key: OA_ADMIN_TOKEN/gu)).toHaveLength(2);
+      expect(manifest.match(/name: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD/gu)).toHaveLength(2);
+      expect(manifest.match(/key: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD/gu)).toHaveLength(2);
+      expect(manifest.match(/name: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD/gu)).toHaveLength(2);
+      expect(manifest.match(/key: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD/gu)).toHaveLength(2);
       expect(manifest).toContain("name: PIKAOA_MAX_UPLOAD_BYTES");
       expect(manifest).toContain('value: "104857600"');
       expect(script).toContain("grep -Eq '@sha256:[0-9a-f]{64}$'");
diff --git a/scripts/src/pikaoa-runtime-manifest.ts b/scripts/src/pikaoa-runtime-manifest.ts
index b63fb00b..8edb7be6 100644
--- a/scripts/src/pikaoa-runtime-manifest.ts
+++ b/scripts/src/pikaoa-runtime-manifest.ts
@@ -98,20 +98,8 @@ export function renderPikaoaRuntimeManifest(
         },
       },
     },
-    deployment(target, context, "api", context.apiImage, apiSelector, target.runtime.apiPort, prometheusPodLabels, commonPodAnnotations(target.observability.apiMetricsPath, target.runtime.apiPort), [
-      { name: "PIKAOA_CONFIG", value: "/etc/pikaoa/pikaoa.yaml" },
-      { name: "DATABASE_URL", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.database.connection.targetKey } } },
-      { name: "PIKAOA_SESSION_SECRET", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.sessionSecret.targetKey } } },
-      { name: "OA_ADMIN_TOKEN", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.adminToken.targetKey } } },
-      { name: "PIKAOA_BOOTSTRAP_ADMIN_USERNAME", value: target.runtime.administrator.username },
-      { name: "PIKAOA_BOOTSTRAP_ADMIN_PASSWORD", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.administrator.password.targetKey } } },
-      { name: "PIKAOA_BOOTSTRAP_EMPLOYEE_USERNAME", value: target.runtime.employee.username },
-      { name: "PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.employee.password.targetKey } } },
-    ], target.probes.apiLivenessPath, target.probes.apiReadinessPath),
-    deployment(target, context, "worker", context.workerImage, workerSelector, target.runtime.workerMetricsPort, prometheusPodLabels, commonPodAnnotations(target.observability.workerMetricsPath, target.runtime.workerMetricsPort), [
-      { name: "PIKAOA_CONFIG", value: "/etc/pikaoa/pikaoa.yaml" },
-      { name: "DATABASE_URL", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.database.connection.targetKey } } },
-    ], target.probes.workerLivenessPath, target.probes.workerReadinessPath),
+    deployment(target, context, "api", context.apiImage, apiSelector, target.runtime.apiPort, prometheusPodLabels, commonPodAnnotations(target.observability.apiMetricsPath, target.runtime.apiPort), applicationEnv(target), target.probes.apiLivenessPath, target.probes.apiReadinessPath),
+    deployment(target, context, "worker", context.workerImage, workerSelector, target.runtime.workerMetricsPort, prometheusPodLabels, commonPodAnnotations(target.observability.workerMetricsPath, target.runtime.workerMetricsPort), applicationEnv(target), target.probes.workerLivenessPath, target.probes.workerReadinessPath),
     deployment(target, context, "web", context.webImage, webSelector, target.runtime.webPort, {}, {}, [
       { name: target.runtime.webApiUpstreamEnv, value: `http://${target.runtime.apiServiceName}.${context.namespace}.svc.cluster.local:${target.runtime.apiPort}` },
       { name: "PIKAOA_MAX_UPLOAD_BYTES", value: String(target.runtime.attachment.maxBytes) },
@@ -119,6 +107,19 @@ export function renderPikaoaRuntimeManifest(
   ];
 }
 
+function applicationEnv(target: PikaoaRuntimeSpec): Array<Record<string, unknown>> {
+  return [
+    { name: "PIKAOA_CONFIG", value: "/etc/pikaoa/pikaoa.yaml" },
+    { name: "DATABASE_URL", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.database.connection.targetKey } } },
+    { name: "PIKAOA_SESSION_SECRET", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.sessionSecret.targetKey } } },
+    { name: "OA_ADMIN_TOKEN", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.adminToken.targetKey } } },
+    { name: "PIKAOA_BOOTSTRAP_ADMIN_USERNAME", value: target.runtime.administrator.username },
+    { name: "PIKAOA_BOOTSTRAP_ADMIN_PASSWORD", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.administrator.password.targetKey } } },
+    { name: "PIKAOA_BOOTSTRAP_EMPLOYEE_USERNAME", value: target.runtime.employee.username },
+    { name: "PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.employee.password.targetKey } } },
+  ];
+}
+
 export function ownershipLabels(target: PikaoaRuntimeSpec, context: PikaoaRuntimeRenderContext): Record<string, string> {
   const release = target.source.branch === "release";
   return {