diff --git a/kubernetes/storage/apps/default/kopia/app/externalsecret.yaml b/kubernetes/storage/apps/default/kopia/app/externalsecret.yaml
index f342575a47c2a..1a96871bb0dec 100644
--- a/kubernetes/storage/apps/default/kopia/app/externalsecret.yaml
+++ b/kubernetes/storage/apps/default/kopia/app/externalsecret.yaml
@@ -13,11 +13,10 @@ spec:
     template:
       engineVersion: v2
       data:
-        # App
-        KOPIA_PASSWORD: "{{ .kopia_repo_password }}"
+        KOPIA_PASSWORD: "{{ .KOPIA_PASSWORD }}"
   dataFrom:
     - extract:
-        key: kopia-b2-storage
+        key: kopia
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
 apiVersion: external-secrets.io/v1beta1
@@ -39,4 +38,4 @@ spec:
               - key: repository.config
   dataFrom:
     - extract:
-        key: kopia-b2-storage
+        key: cloudflare
diff --git a/kubernetes/storage/apps/default/kopia/app/resources/repository.config b/kubernetes/storage/apps/default/kopia/app/resources/repository.config
index 465acb98a615c..aeee036a10cd6 100644
--- a/kubernetes/storage/apps/default/kopia/app/resources/repository.config
+++ b/kubernetes/storage/apps/default/kopia/app/resources/repository.config
@@ -1,10 +1,11 @@
 {
   "storage": {
-    "type": "b2",
+    "type": "s3",
     "config": {
-      "bucket": "expanse-xD6942o1",
-      "keyID": "{{ .b2_app_key_id }}",
-      "key": "{{ .b2_app_key }}"
+      "bucket": "expanse",
+      "endpoint": "{{ .CLOUDFLARE_ACCOUNT_TAG }}.r2.cloudflarestorage.com",
+      "accessKeyID": "{{ .AWS_ACCESS_KEY_ID }}",
+      "secretAccessKey": "{{ .AWS_SECRET_ACCESS_KEY }}"
     }
   },
   "caching": {