diff --git a/justfile b/justfile
index 4b49ce3..aa8b717 100644
--- a/justfile
+++ b/justfile
@@ -51,7 +51,7 @@ _host-preseed platform:
 
 # compose
 
-# Deploy/remove stacks
+# Up/down Docker stacks
 [group('System setup')]
 [arg("stack", long, short="s")]
 compose action hostname='' stack='all': _check-password
@@ -60,7 +60,7 @@ compose action hostname='' stack='all': _check-password
     if [ "{{action}}" = "up" ]; then
         skip_tags="down"
     elif [ "{{action}}" = "down" ]; then
-        skip_tags="deploy,up"
+        skip_tags="up"
     else
         echo "action must be 'up' or 'down'" >&2; exit 1;
     fi
diff --git a/roles/karo-compose/defaults/main/main.yml b/roles/karo-compose/defaults/main/main.yml
index ee89610..c8e74f0 100644
--- a/roles/karo-compose/defaults/main/main.yml
+++ b/roles/karo-compose/defaults/main/main.yml
@@ -53,3 +53,5 @@ karo_compose_oidc_certificate_url: "{{ karo_compose_oidc_url }}{{ karo_compose_o
 # internal
 
 karo_compose_justfile_stack: all
+
+karo_compose_secrets_path: ""
diff --git a/roles/karo-compose/tasks/deploy.yml b/roles/karo-compose/tasks/deploy.yml
deleted file mode 100644
index e17971f..0000000
--- a/roles/karo-compose/tasks/deploy.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-# SPDX-FileCopyrightText: 2025 hazzuk
-#
-# SPDX-License-Identifier: AGPL-3.0-only
-
----
-
-- name: "Create compose stack directory for {{ stack.name }}"
-  ansible.builtin.file:
-    path: "/srv/docker/{{ stack.path }}"
-    mode: "0774"
-    state: directory
-
-- name: "Merge compose variables for {{ stack.name }}"
-  ansible.builtin.set_fact:
-    compose: "{{ stack_defaults | combine(stack_vars, recursive=true) }}"
-
-- name: "Deploy compose templates for {{ stack.name }}"
-  ansible.builtin.template:
-    src: "{{ template.src }}"
-    dest: "/srv/docker/{{ stack.path }}/{{ template.path | splitext | first }}"
-    mode: "0644"
-  loop: "{{ query('filetree', '../templates/' ~ stack.path) }}"
-  loop_control:
-    loop_var: template
-    label: "{{ template.path }}"
diff --git a/roles/karo-compose/tasks/main.yml b/roles/karo-compose/tasks/main.yml
index a77e555..738e058 100644
--- a/roles/karo-compose/tasks/main.yml
+++ b/roles/karo-compose/tasks/main.yml
@@ -86,25 +86,7 @@
         - stack.enabled
         - karo_compose_justfile_stack in [stack.name, 'all']
 
-- name: Deploy stacks
-  become: true
-  become_user: dockeruser
-  tags: deploy
-  block:
-    - name: Deploy docker compose stacks
-      ansible.builtin.include_tasks: deploy.yml
-      loop: "{{ karo_compose_expanded_stacks }}"
-      loop_control:
-        loop_var: stack
-        label: "{{ stack.name }}"
-      vars:
-        stack_vars: "{{ lookup('vars', stack.namespace ~ '_stack') }}"
-        stack_defaults: "{{ lookup('vars', stack.namespace ~ '_stack_defaults') }}"
-      when:
-        - stack.enabled
-        - karo_compose_justfile_stack in [stack.name, 'all']
-
-- name: Create stacks
+- name: Up stacks
   become: true
   become_user: dockeruser
   tags: up
@@ -116,7 +98,10 @@
         loop_var: stack
         label: "{{ stack.name }}"
       vars:
-        stack_secrets: "{{ lookup('vars', stack.namespace ~ '_secrets', default={}) | dict2items }}"
+        stack_vars: "{{ lookup('vars', stack.namespace ~ '_stack') }}"
+        stack_defaults: "{{ lookup('vars', stack.namespace ~ '_stack_defaults') }}"
+        stack_secrets: "{{ query('filetree', '../templates/' ~ stack.path ~ '/secrets') }}"
+        karo_compose_secrets_path: "/run/user/1001/karo-compose/{{ stack.path }}"
       when:
         - stack.enabled
         - karo_compose_justfile_stack in [stack.name, 'all']
@@ -124,7 +109,7 @@
   always:
     - name: Discard tmpfs secrets directory
       ansible.builtin.file:
-        path: "/run/user/1001/karo/compose"
+        path: "/run/user/1001/karo-compose"
         state: absent
       when: secrets_dir | default(false)
       changed_when: false
diff --git a/roles/karo-compose/tasks/up.yml b/roles/karo-compose/tasks/up.yml
index 1fc2f57..febe88c 100644
--- a/roles/karo-compose/tasks/up.yml
+++ b/roles/karo-compose/tasks/up.yml
@@ -4,14 +4,36 @@
 
 ---
 
+# deploy templates
+
+- name: "Create compose stack directory for {{ stack.name }}"
+  ansible.builtin.file:
+    path: "/srv/docker/{{ stack.path }}"
+    mode: "0774"
+    state: directory
+
+- name: "Merge compose variables for {{ stack.name }}"
+  ansible.builtin.set_fact:
+    compose: "{{ stack_defaults | combine(stack_vars, recursive=true) }}"
+
+- name: "Deploy compose templates for {{ stack.name }}"
+  ansible.builtin.template:
+    src: "{{ template.src }}"
+    dest: "/srv/docker/{{ stack.path }}/{{ template.path | splitext | first }}"
+    mode: "0644"
+  loop: "{{ query('filetree', '../templates/' ~ stack.path, exclude='^secrets$') }}"
+  loop_control:
+    loop_var: template
+    label: "{{ template.path }}"
+
+# handle secrets
+
 - name: Prepare secrets
-  when:
-    - stack_secrets | length > 0
-    - secrets_dir is undefined
+  when: stack_secrets | length > 0
   block:
     - name: Create tmpfs secrets directory
       ansible.builtin.file:
-        path: /run/user/1001/karo/compose
+        path: "{{ karo_compose_secrets_path }}"
         state: directory
         mode: "0700"
       changed_when: false
@@ -19,17 +41,21 @@
     - name: Mark secrets directory as created
       ansible.builtin.set_fact:
         secrets_dir: true
+      when: secrets_dir is undefined
 
-- name: Create secrets for {{ stack.name }}
-  ansible.builtin.copy:
-    dest: "/run/user/1001/karo/compose/{{ secret.key }}"
-    content: "{{ secret.value }}"
-    mode: "0644"
-  loop: "{{ stack_secrets }}"
-  loop_control:
-    loop_var: secret
-    label: "{{ secret.key }}"
-  changed_when: false
+    - name: Create secrets for {{ stack.name }}
+      ansible.builtin.copy:
+        # secrets template, removing end of file newline
+        content: "{{ lookup('template', secret.src) | regex_replace('(\r?\n)$', '') }}"
+        dest: "{{ karo_compose_secrets_path }}/{{ secret.path | splitext | first }}"
+        mode: "0644"
+      loop: "{{ stack_secrets }}"
+      loop_control:
+        loop_var: secret
+        label: "{{ secret.path | splitext | first }}"
+      changed_when: false
+
+# start services
 
 - name: Up compose stack {{ stack.name }}
   community.docker.docker_compose_v2: