diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 3ec83e2..8494cba 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -5,6 +5,7 @@ resources:
   - ca-configmap.yaml
   - secrets/clustersecretstore.yaml
   - secrets/externalsecret.yaml
+  - secrets/agent-externalsecret.yaml
   - postgres/statefulset.yaml
   - postgres/service.yaml
   - n8n/pvc.yaml
diff --git a/k8s/n8n/configmap.yaml b/k8s/n8n/configmap.yaml
index acfb155..5c94c5a 100644
--- a/k8s/n8n/configmap.yaml
+++ b/k8s/n8n/configmap.yaml
@@ -33,3 +33,13 @@ data:
   N8N_DIAGNOSTICS_ENABLED: "false"
   N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
   N8N_RUNNERS_ENABLED: "true"
+
+  # Lets a workflow read `$env.<NAME>`. n8n blocks this by default, which is the
+  # right default for an instance where anyone can write a workflow — here it is
+  # how an agent's client secret reaches the workflow that acts as that agent,
+  # without the secret being stored in the workflow JSON and committed.
+  #
+  # It does mean any workflow can read any variable in the pod. That is
+  # acceptable while the instance runs this estate's own agents and nothing
+  # else; it stops being acceptable the moment it is shared.
+  N8N_BLOCK_ENV_ACCESS_IN_NODE: "false"
diff --git a/k8s/n8n/deployment.yaml b/k8s/n8n/deployment.yaml
index e0c51d4..f9ae77e 100644
--- a/k8s/n8n/deployment.yaml
+++ b/k8s/n8n/deployment.yaml
@@ -72,6 +72,11 @@ spec:
           envFrom:
             - configMapRef:
                 name: n8n-config
+            # The agents' Keycloak client secrets, reached from a workflow as
+            # `$env.APPROVISIONNEMENT_CLIENT_SECRET`. A workflow acts as its
+            # agent, so it is the workflow that must be able to exchange tokens.
+            - secretRef:
+                name: n8n-agent-secrets
           volumeMounts:
             - name: data
               mountPath: /home/node/.n8n