diff --git a/firestartr-bootstrap/README.md b/firestartr-bootstrap/README.md
index 74c500da..0043fa5b 100644
--- a/firestartr-bootstrap/README.md
+++ b/firestartr-bootstrap/README.md
@@ -83,6 +83,12 @@ pushFiles:
       terraform:
         push: true # When the process finishes, the generated crs will be pushed to the crs repository.
         repo: "state-infra" # Normally, the state-infra repository will be called "state-infra", but it is possible to change the name.
+      secrets:
+        push: true # When the process finishes, the generated crs will be pushed to the crs repository.
+        repo: "state-secrets" # Normally, the state-secrets repository will be called "state-secrets", but it is possible to change the name.
+  dotFirestartr:
+    push: true # When the process finishes, the generated crs will be pushed to the crs repository.
+    repo: ".firestartr" # Normally, the .firestartr repository will be called ".firestartr", but it is possible to change the name.
 
 components:
   - name: "dot-firestartr" # claim name
@@ -130,6 +136,13 @@ components:
         version: latest  # Check available versions at github.com/prefapp/features
     labels:
       - plan
+
+  - name: "state-secrets"
+    description: "Firestartr Secrets wet repository"
+    defaultBranch: main
+    features:
+      - name: state_secrets
+        version: latest  # Check available versions at github.com/prefapp/features
 ```
 
 All the parameters must be filled. When copy pasting this file, `<placeholders>` must be replaced, but any other values can be treated as defaults and changed if needed:
diff --git a/firestartr-bootstrap/boot/BootstrapFile.yaml.example b/firestartr-bootstrap/boot/BootstrapFile.yaml.example
index 24477ec5..17f0187f 100644
--- a/firestartr-bootstrap/boot/BootstrapFile.yaml.example
+++ b/firestartr-bootstrap/boot/BootstrapFile.yaml.example
@@ -21,6 +21,12 @@ pushFiles:
       terraform:
         push: true # When the process finishes, the generated crs will be pushed to the crs repository.
         repo: "state-infra" # Normally, the state-infra repository will be called "state-infra", but it is possible to change the name.
+      secrets:
+        push: true # When the process finishes, the generated crs will be pushed to the crs repository.
+        repo: "state-secrets" # Normally, the state-secrets repository will be called "state-secrets", but it is possible to change the name.
+  dotFirestartr:
+    push: true # When the process finishes, the generated crs will be pushed to the crs repository.
+    repo: ".firestartr" # Normally, the .firestartr repository will be called ".firestartr", but it is possible to change the name.
 
 components:
   - name: "dot-firestartr" # claim name
@@ -66,3 +72,10 @@ components:
         version: latest  # Check available versions at github.com/prefapp/features
     labels:
       - plan
+
+  - name: "state-secrets"
+    description: "Firestartr Secrets wet repository"
+    defaultBranch: main
+    features:
+      - name: state_secrets
+        version: latest  # Check available versions at github.com/prefapp/features
diff --git a/firestartr-bootstrap/resources.go b/firestartr-bootstrap/resources.go
index 9a3c0c1c..2e264051 100644
--- a/firestartr-bootstrap/resources.go
+++ b/firestartr-bootstrap/resources.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"dagger/firestartr-bootstrap/internal/dagger"
 	"fmt"
+	"strings"
 )
 
 func (m *FirestartrBootstrap) PushBootstrapFiles(
@@ -75,12 +76,40 @@ func (m *FirestartrBootstrap) PushBootstrapFiles(
 	if m.Bootstrap.PushFiles.Crs.Providers.Terraform.Push {
 		crsDir := kindContainer.Directory("/resources/firestartr-crs/infra")
 
+		// Exclude non terraform CRs
+		terraformDir := crsDir.Filter(dagger.DirectoryFilterOpts{
+			Include: []string{"FirestartrTerraformWorkspace.*"},
+		})
+
 		err := m.PushDirToRepo(
 			ctx,
-			crsDir,
+			terraformDir,
 			m.Bootstrap.PushFiles.Crs.Providers.Terraform.Repo,
 			tokenSecret,
 		)
+		if err != nil {
+			if strings.Contains(err.Error(), "nothing to commit") {
+				fmt.Println("No terraform CRs to push, skipping...")
+			} else {
+				return err
+			}
+		}
+	}
+
+	if m.Bootstrap.PushFiles.Crs.Providers.Secrets.Push {
+		crsDir := kindContainer.Directory("/resources/firestartr-crs/infra")
+
+		// Exclude non secret CRs
+		secretsDir := crsDir.Filter(dagger.DirectoryFilterOpts{
+			Include: []string{"ExternalSecret.*"},
+		})
+
+		err := m.PushDirToRepo(
+			ctx,
+			secretsDir,
+			m.Bootstrap.PushFiles.Crs.Providers.Secrets.Repo,
+			tokenSecret,
+		)
 		if err != nil {
 			return err
 		}
diff --git a/firestartr-bootstrap/summary.go b/firestartr-bootstrap/summary.go
index ef189309..5c0e7aab 100644
--- a/firestartr-bootstrap/summary.go
+++ b/firestartr-bootstrap/summary.go
@@ -69,11 +69,18 @@ func (m *FirestartrBootstrap) UpdateSummaryAndRunForImportResourcesStep(
 
 	createdInfraResources, err := kindContainer.Directory(
 		"/resources/firestartr-crs/infra",
-	).Entries(ctx)
+	).Glob(ctx, "FirestartrTerraformWorkspace.*")
 	if err != nil {
 		return "", fmt.Errorf("error creating the list of generated infra artifacts: %w", err)
 	}
 
+	createdSecretResources, err := kindContainer.Directory(
+		"/resources/firestartr-crs/infra",
+	).Glob(ctx, "ExternalSecret.*")
+	if err != nil {
+		return "", fmt.Errorf("error creating the list of generated secret artifacts: %w", err)
+	}
+
 	successMessage := fmt.Sprintf(`
 =====================================================
 📥 RESOURCES IMPORTED AND CREATED 📥
@@ -91,6 +98,9 @@ The environment is fully provisioned.
 #### Generated and created resources (Infra):
 - %s
 
+#### Generated and created resources (Secrets):
+- %s
+
 #### Copied to the cache:
 - /import
 - /resources
@@ -98,6 +108,7 @@ The environment is fully provisioned.
 		strings.Join(importedFiles, "\n- "),
 		strings.Join(createdGhResources, "\n- "),
 		strings.Join(createdInfraResources, "\n- "),
+		strings.Join(createdSecretResources, "\n- "),
 	)
 
 	return m.UpdateSummaryAndRun(ctx, successMessage), nil
@@ -130,11 +141,18 @@ func (m *FirestartrBootstrap) UpdateSummaryAndRunForPushResourcesStep(
 
 	pushedInfraCrs, err := kindContainer.Directory(
 		"/resources/firestartr-crs/infra",
-	).Entries(ctx)
+	).Glob(ctx, "FirestartrTerraformWorkspace.*")
 	if err != nil {
 		return "", fmt.Errorf("error creating the list of pushed infra CRs: %w", err)
 	}
 
+	pushedSecretCrs, err := kindContainer.Directory(
+		"/resources/firestartr-crs/infra",
+	).Glob(ctx, "ExternalSecret.*")
+	if err != nil {
+		return "", fmt.Errorf("error creating the list of pushed secret CRs: %w", err)
+	}
+
 	successMessage := fmt.Sprintf(`
 	=====================================================
 				⤴️RESOURCE PUSH COMPLETE ⤴️
@@ -151,6 +169,9 @@ func (m *FirestartrBootstrap) UpdateSummaryAndRunForPushResourcesStep(
 
 #### List of pushed CRs (%s/state-infra)
 	- %s
+
+#### List of pushed CRs (%s/state-secrets)
+	- %s
 	`,
 		m.Bootstrap.Org,
 		strings.Join(pushedClaims, "\n- "),
@@ -158,6 +179,8 @@ func (m *FirestartrBootstrap) UpdateSummaryAndRunForPushResourcesStep(
 		strings.Join(pushedGithubCrs, "\n- "),
 		m.Bootstrap.Org,
 		strings.Join(pushedInfraCrs, "\n- "),
+		m.Bootstrap.Org,
+		strings.Join(pushedSecretCrs, "\n- "),
 	)
 	return m.UpdateSummaryAndRun(ctx, successMessage), nil
 
diff --git a/firestartr-bootstrap/types.go b/firestartr-bootstrap/types.go
index 531cd5c0..0bd0ba4e 100644
--- a/firestartr-bootstrap/types.go
+++ b/firestartr-bootstrap/types.go
@@ -62,6 +62,7 @@ type PushFilesRepo struct {
 type Providers struct {
 	Github    PushFilesRepo `yaml:"github"`
 	Terraform PushFilesRepo `yaml:"terraform"`
+	Secrets   PushFilesRepo `yaml:"secrets"`
 }
 
 type Firestartr struct {