diff --git a/infra/enterprise.ts b/infra/enterprise.ts
index 71acf20b3d..8da0ba19b5 100644
--- a/infra/enterprise.ts
+++ b/infra/enterprise.ts
@@ -1,3 +1,4 @@
+import { SECRET } from "./secret"
 import { domain } from "./stage"
 
 const storage = new sst.cloudflare.Bucket("EnterpriseStorage")
@@ -7,8 +8,8 @@ const enterprise = new sst.cloudflare.x.SolidStart("Enterprise", {
   environment: {
     OPENCODE_STORAGE_ADAPTER: "r2",
     OPENCODE_STORAGE_ACCOUNT_ID: sst.cloudflare.DEFAULT_ACCOUNT_ID,
-    OPENCODE_STORAGE_ACCESS_KEY_ID: "---",
-    OPENCODE_STORAGE_SECRET_ACCESS_KEY: "---",
+    OPENCODE_STORAGE_ACCESS_KEY_ID: SECRET.R2AccessKey.value,
+    OPENCODE_STORAGE_SECRET_ACCESS_KEY: SECRET.R2SecretKey.value,
     OPENCODE_STORAGE_BUCKET: storage.name,
   },
 })
diff --git a/infra/secret.ts b/infra/secret.ts
new file mode 100644
index 0000000000..0b1870fa15
--- /dev/null
+++ b/infra/secret.ts
@@ -0,0 +1,4 @@
+export const SECRET = {
+  R2AccessKey: new sst.Secret("R2AccessKey", "unknown"),
+  R2SecretKey: new sst.Secret("R2SecretKey", "unknown"),
+}