diff --git a/terraform/layer2-k8s/eks-external-secrets.tf b/terraform/layer2-k8s/eks-external-secrets.tf
index 16fd1512..7b8aed94 100644
--- a/terraform/layer2-k8s/eks-external-secrets.tf
+++ b/terraform/layer2-k8s/eks-external-secrets.tf
@@ -4,19 +4,28 @@ locals {
     enabled       = local.helm_releases[index(local.helm_releases.*.id, "external-secrets")].enabled
     chart         = local.helm_releases[index(local.helm_releases.*.id, "external-secrets")].chart
     repository    = local.helm_releases[index(local.helm_releases.*.id, "external-secrets")].repository
-    chart_version = local.helm_releases[index(local.helm_releases.*.id, "external-secrets")].version
+    chart_version = local.helm_releases[index(local.helm_releases.*.id, "external-secrets")].chart_version
     namespace     = local.helm_releases[index(local.helm_releases.*.id, "external-secrets")].namespace
   }
-}
+  external_secrets_values = <<VALUES
+# Environment variables to set on deployment pod
+env:
+  AWS_REGION: ${local.region}
+  AWS_DEFAULT_REGION: ${local.region}
+  POLLER_INTERVAL_MILLISECONDS: 30000
+  # trace, debug, info, warn, error, fatal
+  LOG_LEVEL: warn
+  LOG_MESSAGE_KEY: 'msg'
+  METRICS_PORT: 3001
 
-data "template_file" "external_secrets" {
-  count = local.external_secrets.enabled ? 1 : 0
+serviceAccount:
+  annotations:
+    "eks.amazonaws.com/role-arn": ${local.external_secrets.enabled ? module.aws_iam_external_secrets[0].role_arn : ""}
 
-  template = file("${path.module}/templates/external-secrets-values.yaml")
-  vars = {
-    role_arn = module.aws_iam_external_secrets[count.index].role_arn
-    region   = local.region
-  }
+securityContext:
+  # Required for use of IRSA, see https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html
+  fsGroup: 1000
+VALUES
 }
 
 #tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
@@ -99,7 +108,7 @@ resource "helm_release" "external_secrets" {
   max_history = var.helm_release_history_size
 
   values = [
-    data.template_file.external_secrets[count.index].rendered,
+    local.external_secrets_values
   ]
 
 }
diff --git a/terraform/layer2-k8s/helm-releases.yaml b/terraform/layer2-k8s/helm-releases.yaml
index 7642ef6a..a112483e 100644
--- a/terraform/layer2-k8s/helm-releases.yaml
+++ b/terraform/layer2-k8s/helm-releases.yaml
@@ -57,7 +57,7 @@ releases:
     enabled: true
     chart: kubernetes-external-secrets
     repository: https://external-secrets.github.io/kubernetes-external-secrets
-    version: 6.3.0
+    chart_version: 6.3.0
     namespace: external-secrets
   - id: gitlab-runner
     enabled: false
diff --git a/terraform/layer2-k8s/templates/external-secrets-values.yaml b/terraform/layer2-k8s/templates/external-secrets-values.yaml
deleted file mode 100644
index 2e80accd..00000000
--- a/terraform/layer2-k8s/templates/external-secrets-values.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# Environment variables to set on deployment pod
-env:
-  AWS_REGION: ${region}
-  AWS_DEFAULT_REGION: ${region}
-  POLLER_INTERVAL_MILLISECONDS: 30000
-  # trace, debug, info, warn, error, fatal
-  LOG_LEVEL: warn
-  LOG_MESSAGE_KEY: 'msg'
-  METRICS_PORT: 3001
-
-serviceAccount:
-  annotations:
-    "eks.amazonaws.com/role-arn": ${role_arn}
-
-securityContext:
-  # Required for use of IRSA, see https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html
-  fsGroup: 1000