diff --git a/deploy-db.sh b/deploy-db.sh
index 04d6d2f..f1b1895 100755
--- a/deploy-db.sh
+++ b/deploy-db.sh
@@ -1,68 +1,118 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Deploy Postgres for la-huasca in its own namespace
+
 NAMESPACE="la-huasca"
 SECRET_NAME="la-huasca-db-secrets"
-PROTECTED_FILE="$HOME/.lahuasca-db-pass.enc"
-PIN="78963"
+PVC_NAME="postgres-data"
 
-generate_password() {
-  openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 32
-}
+# Generate a secure random password if secret doesn't exist yet
+if ! kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" >/dev/null 2>&1; then
+  echo "==> Generating database password ..."
+  PASSWORD=*** 75d7 | base64 | head -c 32 | tr -d '
+'
+  DATABASE_URL="postgres://lahuasca:$PASSWORD@postgres.$NAMESPACE.svc.cluster.local:5432/lahuasca"
 
-decrypt_password() {
-  openssl enc -aes-256-cbc -d -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -in "$PROTECTED_FILE" | tr -d '\n'
-}
-
-# Generate a secure random password if it doesn't already exist
-if [ -f "$PROTECTED_FILE" ]; then
-  echo "Protected password file already exists at $PROTECTED_FILE"
-  echo "Run './deploy-db.sh reveal' to view it."
+  kubectl create secret generic "$SECRET_NAME" \
+    --namespace "$NAMESPACE" \
+    --from-literal=POSTGRES_USER=lahuasca \
+    --from-literal=POSTGRES_PASSWORD="$PASSWORD" \
+    --from-literal=POSTGRES_DB=lahuasca \
+    --from-literal=DATABASE_URL="$DATABASE_URL"
+  echo "==> Created $SECRET_NAME"
 else
-  PASSWORD=***
-  if [ -z "$PASSWORD" ]; then
-    echo "Failed to generate password. Is openssl installed?"
-    exit 1
-  fi
-  echo -n "$PASSWORD" | openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -out "$PROTECTED_FILE"
-  echo "Generated secure password and saved it to $PROTECTED_FILE"
+  echo "==> $SECRET_NAME already exists, leaving it"
 fi
 
-if [ "${1:-}" = "reveal" ]; then
-  echo "Enter PIN to reveal the database password:"
-  read -s USER_PIN
-  if [ "$USER_PIN" != "$PIN" ]; then
-    echo "Incorrect PIN."
-    exit 1
-  fi
-  PASSWORD=***
-  if [ -z "$PASSWORD" ]; then
-    echo "Failed to decrypt password."
-    exit 1
-  fi
-  echo "Database password: $PASSWORD"
-  exit 0
-fi
-
-# Read password for deployment
-PASSWORD=***
-if [ -z "$PASSWORD" ]; then
-  echo "Failed to decrypt password. Protected file may be corrupt."
-  exit 1
-fi
-
-cat <<EOF | kubectl apply -f -
+# Ensure PVC exists
+if ! kubectl get pvc "$PVC_NAME" -n "$NAMESPACE" >/dev/null 2>&1; then
+  echo "==> Creating Postgres PVC ..."
+  cat <<EOF | kubectl apply -f -
 apiVersion: v1
-kind: Secret
+kind: PersistentVolumeClaim
 metadata:
-  name: $SECRET_NAME
+  name: $PVC_NAME
   namespace: $NAMESPACE
-type: Opaque
-stringData:
-  POSTGRES_USER: lahuasca
-  POSTGRES_PASSWORD: "$PASSWORD"
-  POSTGRES_DB: lahuasca
-  DATABASE_URL: "postgres://lahuasca:${PASSWORD}@postgres:5432/lahuasca"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+EOF
+fi
+
+# Deploy Postgres
+cat <<EOF | kubectl apply -f -
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: $NAMESPACE
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:15-alpine
+          ports:
+            - containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: $SECRET_NAME
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: $SECRET_NAME
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: $SECRET_NAME
+                  key: POSTGRES_DB
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: $PVC_NAME
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: $NAMESPACE
+spec:
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
 EOF
 
-echo "Database secret updated in namespace $NAMESPACE"
+echo "==> Waiting for postgres to be ready ..."
+kubectl rollout status deployment/postgres -n "$NAMESPACE" --timeout=120s
+
+echo ""
+echo "Postgres ready in namespace $NAMESPACE"
+echo "To reveal the password:"
+echo "  kubectl get secret $SECRET_NAME -n $NAMESPACE -o jsonpath='{.data.DATABASE_URL}' | base64 -d"