diff --git a/scripts/src/platform-infra.ts b/scripts/src/platform-infra.ts
index 3dea94a2..142500ea 100644
--- a/scripts/src/platform-infra.ts
+++ b/scripts/src/platform-infra.ts
@@ -721,11 +721,11 @@ function parseRuntime(root: Record<string, unknown>): Sub2ApiConfig["runtime"] {
   const database = objectField(runtime, "database", "runtime");
   const databaseMode = enumField(database, "mode", "runtime.database", ["external"] as const);
   const sourceRef = stringField(database, "sourceRef", "runtime.database");
-  const sourceKeysRaw = database.sourceKeys === undefined ? {} : objectField(database, "sourceKeys", "runtime.database");
+  const sourceKeysRaw = objectField(database, "sourceKeys", "runtime.database");
   const sourceKeys = {
-    user: sourceKeysRaw.user === undefined ? "SUB2API_DB_USER" : stringField(sourceKeysRaw, "user", "runtime.database.sourceKeys"),
-    password: sourceKeysRaw.password === undefined ? "SUB2API_DB_PASSWORD" : stringField(sourceKeysRaw, "password", "runtime.database.sourceKeys"),
-    dbName: sourceKeysRaw.dbName === undefined ? "SUB2API_DB_NAME" : stringField(sourceKeysRaw, "dbName", "runtime.database.sourceKeys"),
+    user: stringField(sourceKeysRaw, "user", "runtime.database.sourceKeys"),
+    password: stringField(sourceKeysRaw, "password", "runtime.database.sourceKeys"),
+    dbName: stringField(sourceKeysRaw, "dbName", "runtime.database.sourceKeys"),
   };
   const secret = stringField(database, "secretName", "runtime.database");
   const passwordKey = stringField(database, "passwordKey", "runtime.database");
@@ -751,9 +751,9 @@ function parseRuntime(root: Record<string, unknown>): Sub2ApiConfig["runtime"] {
   const redisServiceName = stringField(redis, "serviceName", "runtime.redis");
   const redisPersistence = booleanField(redis, "persistence", "runtime.redis");
   if (!isKubernetesName(redisServiceName)) throw new Error(`${configPath}.runtime.redis.serviceName must be a Kubernetes Service name`);
-  const secretsRaw = runtime.secrets === undefined ? {} : objectField(runtime, "secrets", "runtime");
-  const secretRoot = secretsRaw.root === undefined ? ".state/secrets" : stringField(secretsRaw, "root", "runtime.secrets");
-  const appSourceRef = secretsRaw.appSourceRef === undefined ? "platform-infra/sub2api.env" : stringField(secretsRaw, "appSourceRef", "runtime.secrets");
+  const secretsRaw = objectField(runtime, "secrets", "runtime");
+  const secretRoot = stringField(secretsRaw, "root", "runtime.secrets");
+  const appSourceRef = stringField(secretsRaw, "appSourceRef", "runtime.secrets");
   if (!/^[A-Za-z0-9_./-]+$/u.test(secretRoot)) throw new Error(`${configPath}.runtime.secrets.root has an unsupported format`);
   if (!/^[A-Za-z0-9_./-]+$/u.test(appSourceRef)) throw new Error(`${configPath}.runtime.secrets.appSourceRef has an unsupported format`);
   const appData = objectField(runtime, "appData", "runtime");