diff --git a/deploy/charts/scrubbed/README.md b/deploy/charts/scrubbed/README.md
index 090ffc6..ccb88de 100644
--- a/deploy/charts/scrubbed/README.md
+++ b/deploy/charts/scrubbed/README.md
@@ -45,6 +45,7 @@ Deploy Scrubbed via Helm
 | signalilo.listenPort | string | `"8888"` | Listen port of Signalilo service |
 | signalilo.resources | object | `{}` | Resource limits and requests for scrubbed |
 | signalilo.serviceName | string | `"signalilo"` | Signalilo service name |
+| signalilo.testSecret | bool | `false` | generate secret for CI testing, if false provide your own. Required keys are SIGNALILO_ALERTMANAGER_BEARER_TOKEN and SIGNALILO_ICINGA_PASSWORD |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
diff --git a/deploy/charts/scrubbed/ci/default-values.yaml b/deploy/charts/scrubbed/ci/default-values.yaml
index 289fb0b..3d562eb 100644
--- a/deploy/charts/scrubbed/ci/default-values.yaml
+++ b/deploy/charts/scrubbed/ci/default-values.yaml
@@ -6,3 +6,4 @@ scrubbed:
 
 signalilo:
   enabled: true
+  testSecret: true
diff --git a/deploy/charts/scrubbed/templates/secret-signalilo.yaml b/deploy/charts/scrubbed/templates/secret-signalilo.yaml
new file mode 100644
index 0000000..f849427
--- /dev/null
+++ b/deploy/charts/scrubbed/templates/secret-signalilo.yaml
@@ -0,0 +1,12 @@
+{{- if and .Values.signalilo.enabled .Values.signalilo.testSecret -}}
+kind: Secret
+apiVersion: v1
+metadata:
+  name: {{ include "scrubbed.fullname" . }}-signalilo
+  labels:
+    {{- include "scrubbed.labels" . | nindent 4 }}
+    app.kubernetes.io/component: signalilo
+stringData::
+  SIGNALILO_ALERTMANAGER_BEARER_TOKEN: foo
+  SIGNALILO_ICINGA_PASSWORD: bar
+{{- end -}}
diff --git a/deploy/charts/scrubbed/values.yaml b/deploy/charts/scrubbed/values.yaml
index 56ada8a..a6ecf18 100644
--- a/deploy/charts/scrubbed/values.yaml
+++ b/deploy/charts/scrubbed/values.yaml
@@ -82,3 +82,5 @@ signalilo:
     #   memory: 16Mi
   # -- Signalilo service name
   serviceName: signalilo
+  # -- generate secret for CI testing, if false provide your own. Required keys are SIGNALILO_ALERTMANAGER_BEARER_TOKEN and SIGNALILO_ICINGA_PASSWORD
+  testSecret: false