diff --git a/getting-started/templates/systemlink-secrets.yaml b/getting-started/templates/systemlink-secrets.yaml
index 56050695..ea83f437 100644
--- a/getting-started/templates/systemlink-secrets.yaml
+++ b/getting-started/templates/systemlink-secrets.yaml
@@ -267,9 +267,12 @@ dataframeservice:
 ##
 fileingestion:
   secrets:
-    ## Cryptographic key used for AES-256 encryption of data at restI. Use a 32-byte cryptographically random value which is base64 encoded.
+    ## Cryptographic key used for AES-256 encryption of data at rest. Use a 32-byte cryptographically random value which is base64 encoded.
     ##
     encryptionKey: ""  # <ATTENTION>
+    ## Cryptographic key to be used for encryption of download tokens. This key should have a length of at least 32 bytes.
+    ##
+    downloadTokenEncryptionKey: "" # <ATTENTION>
     ## Access key information for S3/MinIO access.
     ## If using MinIO, use the user and password from the MinIO configuration above here. Otherwise, S3 credentials will need to be provided.
     ##
@@ -296,6 +299,15 @@ fileingestion:
       ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
       ##
       replicaSetKey: ""  # <ATTENTION>
+    ## Default values for the token used in downloading a file
+    ##
+    downloadToken:
+      ## Availability of the token
+      ##
+      expirySeconds: 60
+      ## The secret used to create the encrypted token
+      ## 
+      encryptionKeySecret: "fileingestionservices-download-encryption-key"
 
 ## Secret configuration for Jupyter notebook execution.
 ##