diff --git a/config/secrets-distribution.yaml b/config/secrets-distribution.yaml
index bdd4527f..a22ad805 100644
--- a/config/secrets-distribution.yaml
+++ b/config/secrets-distribution.yaml
@@ -8,6 +8,7 @@ metadata:
     - 297
     - 300
     - 313
+    - 2256
 
 sources:
   root: /root/unidesk/.state/secrets
@@ -63,6 +64,19 @@ sources:
           UNIDESK_WECHAT_ARCHIVE_TOKEN:
             bytes: 32
             prefix: uwa_
+    - sourceRef: hwlab/jd01-v03-opencode.env
+      type: env
+      requiredKeys:
+        - OPENCODE_SERVER_USERNAME
+        - OPENCODE_SERVER_PASSWORD
+      createIfMissing:
+        enabled: true
+        values:
+          OPENCODE_SERVER_USERNAME: opencode
+        randomBase64Url:
+          OPENCODE_SERVER_PASSWORD:
+            bytes: 32
+            prefix: oc_
 
 targets:
   - id: platform-infra-g14
@@ -70,8 +84,24 @@ targets:
     namespace: platform-infra
     scope: platform-infra
     enabled: true
+  - id: hwlab-jd01-v03
+    route: JD01:k3s
+    namespace: hwlab-v03
+    scope: hwlab
+    enabled: true
 
 kubernetesSecrets:
+  - name: hwlab-jd01-v03-opencode-server-auth
+    targetId: hwlab-jd01-v03
+    secretName: hwlab-v03-opencode-server-auth
+    type: Opaque
+    data:
+      - sourceRef: hwlab/jd01-v03-opencode.env
+        sourceKey: OPENCODE_SERVER_USERNAME
+        targetKey: username
+      - sourceRef: hwlab/jd01-v03-opencode.env
+        sourceKey: OPENCODE_SERVER_PASSWORD
+        targetKey: password
   - name: langbot-runtime
     targetId: platform-infra-g14
     secretName: langbot-secrets