diff --git a/flux2/apps/wekan/release.yaml b/flux2/apps/wekan/release.yaml
index 09774f1f4cef9432b01268cf18f98ea8c0746d71..9f1f7dc6d5d4dc7f853006f68b8c55577ddcd1de 100644
--- a/flux2/apps/wekan/release.yaml
+++ b/flux2/apps/wekan/release.yaml
@@ -98,7 +98,14 @@ spec:
       auth:
         username: wekan
         database: wekan
-        existingSecret: oas-wekan-variables
+        # Unfortunatly we can't use existingSecret directly here because
+        # kustomize-controller doesn't allow hyphens/dashes in variable
+        # substitution names, while mongodb requires hyphens/dashes in the
+        # var names. See https://github.com/fluxcd/kustomize-controller/issues/395
+        # for more details.
+        # existingSecret: oas-wekan-variables
+        rootPassword: ${mongodb_root_password}
+        password: ${mongodb_password}
       podAnnotations:
         # Let the backup system include rocketchat data stored in mongodb.
         backup.velero.io/backup-volumes: "datadir"