diff --git a/cli/app/secret.go b/cli/app/secret.go
index 3b491055..c621d51d 100644
--- a/cli/app/secret.go
+++ b/cli/app/secret.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"strconv"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
@@ -156,6 +157,8 @@ var appSecretInsertCommand = cli.Command{
 	Flags: []cli.Flag{
 		internal.DebugFlag,
 		internal.PassFlag,
+		internal.FileFlag,
+		internal.TrimFlag,
 	},
 	Before:       internal.SubCommandBefore,
 	ArgsUsage:    "<domain> <secret-name> <version> <data>",
@@ -188,6 +191,18 @@ Example:
 		version := c.Args().Get(2)
 		data := c.Args().Get(3)
 
+		if internal.File {
+			raw, err := os.ReadFile(data)
+			if err != nil {
+				logrus.Fatalf("reading secret from file: %s", err)
+			}
+			data = string(raw)
+		}
+
+		if internal.Trim {
+			data = strings.TrimSpace(data)
+		}
+
 		secretName := fmt.Sprintf("%s_%s_%s", app.StackName(), name, version)
 		if err := client.StoreSecret(cl, secretName, data, app.Server); err != nil {
 			logrus.Fatal(err)
diff --git a/cli/internal/cli.go b/cli/internal/cli.go
index e66ab007..ee9e6972 100644
--- a/cli/internal/cli.go
+++ b/cli/internal/cli.go
@@ -38,6 +38,20 @@ var PassRemoveFlag = &cli.BoolFlag{
 	Destination: &PassRemove,
 }
 
+var File bool
+var FileFlag = &cli.BoolFlag{
+	Name:        "file, f",
+	Usage:       "Treat input as a file",
+	Destination: &File,
+}
+
+var Trim bool
+var TrimFlag = &cli.BoolFlag{
+	Name:        "trim, t",
+	Usage:       "Trim input",
+	Destination: &Trim,
+}
+
 // Force force functionality without asking.
 var Force bool
 
diff --git a/tests/integration/app_secret.bats b/tests/integration/app_secret.bats
index b745a939..bcb5e057 100644
--- a/tests/integration/app_secret.bats
+++ b/tests/integration/app_secret.bats
@@ -19,6 +19,13 @@ teardown_file(){
   _reset_recipe
 }
 
+teardown() {
+  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
+  _reset_app
+  _reset_recipe
+  _checkout_recipe
+}
+
 setup(){
   load "$PWD/tests/integration/helpers/common"
   _common_setup
@@ -77,9 +84,6 @@ setup(){
   assert_output --partial 'test_pass_one'
   assert_output --partial 'test_pass_two'
   refute_output --partial 'extra_pass'
-
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
-  assert_success
 }
 
 @test "generate: broken if missing version" {
@@ -91,7 +95,6 @@ setup(){
   assert_failure
   assert_output --partial 'missing version'
 
-  _reset_app
 }
 
 @test "generate: use version from app env" {
@@ -108,11 +111,6 @@ setup(){
   assert_success
   assert_output --partial 'v2'
   refute_output --partial 'v1'
-
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
-  assert_success
-
-  _reset_app
 }
 
 @test "generate: generate extra secret based on COMPOSE_FILE" {
@@ -131,11 +129,6 @@ setup(){
   run docker -c "$TEST_SERVER" secret ls
   assert_success
   assert_output --partial "$TEST_APP_DOMAIN_extra_pass_v1"
-
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
-  assert_success
-
-  _reset_app
 }
 
 @test "generate: bail if unstaged changes and no --chaos" {
@@ -162,8 +155,6 @@ setup(){
 
   run $ABRA app secret rm "$TEST_APP_DOMAIN" --all --chaos
   assert_success
-
-  _checkout_recipe
 }
 
 @test "generate: ensure secret name uses trimmed stack name" {
@@ -228,9 +219,22 @@ setup(){
   run $ABRA app secret ls "$TEST_APP_DOMAIN"
   assert_success
   assert_output --partial 'true'
+}
 
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" test_pass_one
+@test "insert: create secret from file" {
+  run $ABRA app secret ls "$TEST_APP_DOMAIN"
   assert_success
+  assert_output --partial 'false'
+
+  run bash -c "echo bar >> $ABRA_DIR/recipes/$TEST_RECIPE/foo"
+
+  run $ABRA app secret insert --file "$TEST_APP_DOMAIN" test_pass_one v1 "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  assert_success
+  assert_output --partial 'successfully stored on server'
+
+  run $ABRA app secret ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'true'
 }
 
 @test "rm: validate arguments" {
@@ -314,9 +318,6 @@ setup(){
   run $ABRA app secret ls "$TEST_APP_DOMAIN"
   assert_success
   assert_output --partial 'true'
-
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
-  assert_success
 }
 
 @test "ls: show secrets as machine readable" {
@@ -330,9 +331,6 @@ setup(){
   run $ABRA app secret ls "$TEST_APP_DOMAIN" --machine
   assert_success
   assert_output --partial '"created-on-server":"true"'
-
-  run $ABRA app secret rm "$TEST_APP_DOMAIN" --all
-  assert_success
 }
 
 @test "ls: bail if unstaged changes and no --chaos" {