diff --git a/config/hwlab-access-control-secrets.yaml b/config/hwlab-access-control-secrets.yaml
new file mode 100644
index 00000000..9b9aa003
--- /dev/null
+++ b/config/hwlab-access-control-secrets.yaml
@@ -0,0 +1,36 @@
+version: 1
+kind: unidesk-secret-distribution
+
+metadata:
+  id: hwlab-access-control-secrets
+  owner: hwlab
+  relatedIssues:
+    - 2187
+
+sources:
+  root: /root/unidesk/.state/secrets
+  files:
+    - sourceRef: hwlab/d601-v03-preset-users.env
+      type: env
+      requiredKeys:
+        - HUIGGAO_PASSWORD
+        - HWLAB_PRESET_USER_HUIGGAO_PASSWORD_HASH
+      createIfMissing:
+        enabled: false
+
+targets:
+  - id: d601-v03
+    route: D601:k3s
+    namespace: hwlab-v03
+    scope: hwlab-d601-v03
+    enabled: true
+
+kubernetesSecrets:
+  - name: d601-v03-preset-users
+    targetId: d601-v03
+    secretName: hwlab-v03-preset-users
+    type: Opaque
+    data:
+      - sourceRef: hwlab/d601-v03-preset-users.env
+        sourceKey: HWLAB_PRESET_USER_HUIGGAO_PASSWORD_HASH
+        targetKey: huiggao-password-hash