diff --git a/deploy/deployment.yaml b/deploy/deployment.yaml
index c8e6db0a7613782cd5144124efa255c0de4c5978_ZGVwbG95L2RlcGxveW1lbnQueWFtbA==..c5f6e769051cf4007a7a2f88fd37a4363c8acfff_ZGVwbG95L2RlcGxveW1lbnQueWFtbA== 100644
--- a/deploy/deployment.yaml
+++ b/deploy/deployment.yaml
@@ -64,8 +64,11 @@
             - name: static
               mountPath: /etc/cubicweb.d/fresh/data
             - name: cwclientlibrc
-              mountPath: /etc/cubicweb.d/fresh/cwclientlibrc
-              subPath: cwclientlibrc
+              mountPath: /secret
+          command: [
+            "/bin/sh", "-c",
+            "install -m 400 /secret/cwclientlibrc /etc/cubicweb.d/fresh/cwclientlibrc && exec /entrypoint.sh start"
+          ]
           resources:
             requests:
               cpu: 500m
@@ -128,9 +131,11 @@
                 name: fresh-env
           volumeMounts:
             - name: cwclientlibrc
-              mountPath: /etc/cubicweb.d/fresh/cwclientlibrc
-              subPath: cwclientlibrc
-          command: ["cubicweb-ctl", "scheduler", "fresh"]
+              mountPath: /secret
+          command: [
+            "/bin/sh", "-c",
+            "install -m 400 /secret/cwclientlibrc /etc/cubicweb.d/fresh/cwclientlibrc && exec cubicweb-ctl sheduler fresh"
+          ]
           resources:
             requests:
               cpu: 100m