diff --git a/apps/gitea/secret.tf b/apps/gitea/secret.tf
index a3db92e..8edbd8b 100644
--- a/apps/gitea/secret.tf
+++ b/apps/gitea/secret.tf
@@ -1,3 +1,8 @@
+locals {
+  secret-labels = merge(local.common-labels, {
+    "k8up.io/backup" = "true"
+  })
+}
 
 resource "kubectl_manifest" "gitea_secret" {
   ignore_fields = ["metadata.annotations"]
@@ -7,7 +12,7 @@ resource "kubectl_manifest" "gitea_secret" {
     metadata:
       name: "gitea-admin-user"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(local.common-labels)}
+      labels: ${jsonencode(local.secret-labels)}
     spec:
       forceRegenerate: false
       data: