diff --git a/.envrc.sample b/.envrc.sample
index 847a9ff..1dc78f7 100644
--- a/.envrc.sample
+++ b/.envrc.sample
@@ -14,9 +14,9 @@ export MEDIAWIKI_LOGO_FILE='$wgResourceBasePath/resources/assets/wiki.png'
 #export SMTP_HOST=postfix_relay_app
 #export SMTP_HOST=mailu_front
 
-export DB_ROOT_PASSWORD_VERSION=v1
-export DB_PASSWORD_VERSION=v1
-export MEDIAWIKI_SECRET_KEY_VERSION=v1
+export SECRET_DB_ROOT_PASSWORD_VERSION=v1
+export SECRET_DB_PASSWORD_VERSION=v1
+export SECRET_MEDIAWIKI_SECRET_KEY_VERSION=v1 # length=64
 
 export LOCAL_SETTINGS_CONF_VERSION=v1
 export HTACCESS_CONF_VERSION=v1
@@ -37,8 +37,8 @@ export PHP_INI_VERSION=v1
 #export SAML_AUTH_SOURCE_ID=default-sp
 #export SAML_USERNAME_ATTRIBUTE=user
 
-#export SAML_ADMIN_PASSWORD_VERSION=v1
-#export SAML_SECRET_SALT_VERSION=v1
+#export SECRET_SAML_ADMIN_PASSWORD_VERSION=v1
+#export SECRET_SAML_SECRET_SALT_VERSION=v1 # length=64
 
 #export SAML_ENTRYPOINT_CONF_VERSION=v1
 
@@ -47,4 +47,4 @@ export PHP_INI_VERSION=v1
 # export COMPOSE_FILE="compose.yml:compose.openid.yml"
 # export OPENID_KEYCLOAK_URL="https://keycloak.local:8080/auth/realms/acme/"
 # export OPENID_CLIENT_ID="mediawiki"
-# export OPENID_CLIENT_SECRET_VERSION=v1
+# export SECRET_OPENID_CLIENT_SECRET_VERSION=v1
diff --git a/compose.openid.yml b/compose.openid.yml
index 15075c6..58ce4e1 100644
--- a/compose.openid.yml
+++ b/compose.openid.yml
@@ -14,7 +14,7 @@ services:
 
 secrets:
   openid_client_secret:
-    name: ${STACK_NAME}_openid_client_secret_${OPENID_CLIENT_SECRET_VERSION}
+    name: ${STACK_NAME}_openid_client_secret_${SECRET_OPENID_CLIENT_SECRET_VERSION}
     external: true
 
 configs:
diff --git a/compose.simplesaml.yml b/compose.simplesaml.yml
index 4450901..9dcaf92 100644
--- a/compose.simplesaml.yml
+++ b/compose.simplesaml.yml
@@ -66,10 +66,10 @@ volumes:
 
 secrets:
   saml_admin_password:
-    name: ${STACK_NAME}_saml_admin_password_${SAML_ADMIN_PASSWORD_VERSION}
+    name: ${STACK_NAME}_saml_admin_password_${SECRET_SAML_ADMIN_PASSWORD_VERSION}
     external: true
   saml_secret_salt:
-    name: ${STACK_NAME}_saml_secret_salt_${SAML_SECRET_SALT_VERSION}
+    name: ${STACK_NAME}_saml_secret_salt_${SECRET_SAML_SECRET_SALT_VERSION}
     external: true
 
 configs:
diff --git a/compose.yml b/compose.yml
index ceeda50..dda245b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -88,13 +88,13 @@ networks:
 
 secrets:
   db_root_password:
-    name: ${STACK_NAME}_db_root_password_${DB_ROOT_PASSWORD_VERSION}
+    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
     external: true
   db_password:
-    name: ${STACK_NAME}_db_password_${DB_PASSWORD_VERSION}
+    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
     external: true
   mediawiki_secret_key:
-    name: ${STACK_NAME}_mediawiki_secret_key_${MEDIAWIKI_SECRET_KEY_VERSION}
+    name: ${STACK_NAME}_mediawiki_secret_key_${SECRET_MEDIAWIKI_SECRET_KEY_VERSION}
     external: true
 
 configs: