diff --git a/config/secrets-distribution.yaml b/config/secrets-distribution.yaml
index da64f964..5c5c8143 100644
--- a/config/secrets-distribution.yaml
+++ b/config/secrets-distribution.yaml
@@ -64,6 +64,29 @@ sources:
           UNIDESK_WECHAT_ARCHIVE_TOKEN:
             bytes: 32
             prefix: uwa_
+    - sourceRef: platform-infra/sub2api.env
+      type: env
+      requiredKeys:
+        - ADMIN_EMAIL
+        - ADMIN_PASSWORD
+      createIfMissing:
+        enabled: false
+    - sourceRef: platform-infra/pk01-frp.env
+      type: env
+      requiredKeys:
+        - FRP_TOKEN
+      createIfMissing:
+        enabled: false
+    - sourceRef: platform-infra/sub2rank.env
+      type: env
+      requiredKeys:
+        - SUB2RANK_ADMIN_TOKEN
+      createIfMissing:
+        enabled: true
+        randomBase64Url:
+          SUB2RANK_ADMIN_TOKEN:
+            bytes: 32
+            prefix: srk_
     - sourceRef: hwlab/jd01-v03-opencode.env
       type: env
       requiredKeys:
@@ -103,6 +126,11 @@ targets:
     namespace: platform-infra
     scope: platform-infra
     enabled: true
+  - id: sub2rank-nc01
+    route: NC01:k3s
+    namespace: platform-infra
+    scope: sub2rank
+    enabled: true
   - id: hwlab-jd01-v03
     route: JD01:k3s
     namespace: hwlab-v03
@@ -115,6 +143,23 @@ targets:
     enabled: true
 
 kubernetesSecrets:
+  - name: sub2rank-runtime
+    targetId: sub2rank-nc01
+    secretName: sub2rank-secrets
+    type: Opaque
+    data:
+      - sourceRef: platform-infra/sub2rank.env
+        sourceKey: SUB2RANK_ADMIN_TOKEN
+        targetKey: SUB2RANK_ADMIN_TOKEN
+      - sourceRef: platform-infra/sub2api.env
+        sourceKey: ADMIN_EMAIL
+        targetKey: SUB2API_ADMIN_EMAIL
+      - sourceRef: platform-infra/sub2api.env
+        sourceKey: ADMIN_PASSWORD
+        targetKey: SUB2API_ADMIN_PASSWORD
+      - sourceRef: platform-infra/pk01-frp.env
+        sourceKey: FRP_TOKEN
+        targetKey: FRP_TOKEN
   - name: hwlab-web-probe-monitor-db
     targetId: hwlab-nc01-v03
     secretName: hwlab-web-probe-monitor-db