diff --git a/contrib/charts/espresso/templates/deployment.yaml b/contrib/charts/espresso/templates/deployment.yaml
index 7a9500f753950f6a3897906514714b2202a24fce..96cea55d5f3851aa4ce4fb30c8c914fe99b87b63 100644
--- a/contrib/charts/espresso/templates/deployment.yaml
+++ b/contrib/charts/espresso/templates/deployment.yaml
@@ -1,7 +1,8 @@
+{{- $fullName := include "chart.fullname" . -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "chart.fullname" . }}
+  name: {{ $fullName }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 spec:
@@ -33,8 +34,19 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ['/usr/bin/espresso']
           args:
             - serve
+          env:
+          {{- if .Values.secretEnvVars }}
+          {{- range $index, $value := .Values.secretEnvVars }}
+            - name: {{ $index }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $fullName }}
+                  key: {{ $index }}
+          {{- end }}
+          {{- end }}
           ports:
             - name: http
               containerPort: 80
diff --git a/contrib/charts/espresso/templates/secret.yaml b/contrib/charts/espresso/templates/secret.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..6b07de23e77669e23e33b533ec00c3b7112b7f21
--- /dev/null
+++ b/contrib/charts/espresso/templates/secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "chart.fullname" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+data:
+{{- range $index, $value := .Values.secretEnvVars }}
+  {{ $index }}: {{ $value | b64enc }}
+{{- end }}
diff --git a/contrib/charts/espresso/values.yaml b/contrib/charts/espresso/values.yaml
index fbdaba566e2fe00c68cc5e12f58976fda0d5aaa6..e8dd2dbe6e4660287dc4d3cfab45ccfbdb1236a2 100644
--- a/contrib/charts/espresso/values.yaml
+++ b/contrib/charts/espresso/values.yaml
@@ -26,6 +26,11 @@ config: |
   [unbundler]
   poll_seconds = 10
 
+# Specify additional environment variables to be passed to the Espresso server,
+# stored as a Kubernetes secret.
+secretEnvVars: {}
+# ESPRESSO_BUNDLE: '{access_key = "XXXX", secret_key = "XXXX"}'
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true