diff --git a/argo/apps/values.yaml b/argo/apps/values.yaml
index e206f61..c068614 100644
--- a/argo/apps/values.yaml
+++ b/argo/apps/values.yaml
@@ -60,3 +60,13 @@ helmApps:
     repoURL: https://immich-app.github.io/immich-charts
     chart: immich
     revision: 0.1.2
+  - app: zitadel
+    namespace: zitadel
+    repoURL: https://charts.zitadel.com
+    chart: zitadel
+    revision: 5.0.0
+  - app: cockroachdb
+    namespace: crdb
+    repoURL: https://charts.cockroachdb.com/
+    chart: cockroachdb
+    revision: 11.1.0
diff --git a/argo/cockroachdb/values.yaml b/argo/cockroachdb/values.yaml
new file mode 100644
index 0000000..f4f398e
--- /dev/null
+++ b/argo/cockroachdb/values.yaml
@@ -0,0 +1,8 @@
+---
+name: crdb
+namespace: crdb
+serviceAccountName: crdb
+fullnameOverride: crdb
+single-node: true
+statefulset:
+  replicas: 1
diff --git a/argo/zitadel/values.yaml b/argo/zitadel/values.yaml
new file mode 100644
index 0000000..1495475
--- /dev/null
+++ b/argo/zitadel/values.yaml
@@ -0,0 +1,58 @@
+---
+name: zitadel
+namespace: zitadel
+serviceAccountName: crdb
+externalSecrets:
+  secretStoreName: zitadel
+  vaultRole: zitadel
+  secretPaths:
+    - name: zitadel
+      secrets:
+      - secretKey: masterkey
+        key: zitadel
+        property: masterkey
+      - secretKey: config-yaml
+        key: zitadel
+        property: config-yaml
+
+zitadel:
+  # https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
+  configmapConfig:
+    ExternalSecure: false
+    TLS:
+      Enabled: false
+    Database:
+      cockroach:
+        Host: "crdb-public"
+        User:
+          SSL:
+            Mode: "verify-full"
+        Admin:
+          SSL:
+            Mode: "verify-full"
+
+    Machine:
+      Identification:
+        Hostname:
+          Enabled: true
+        Webhook:
+          Enabled: false
+
+  masterkeySecretName: "zitadel"
+
+serviceAccount:
+  create: false
+  annotations: {}
+  name: "zitadel"
+
+initJob:
+  # Once ZITADEL is installed, the initJob can be disabled.
+  enabled: true
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "1"
+  resources: {}
+  activeDeadlineSeconds: 300
+  extraContainers: []
+  podAnnotations: {}