diff --git a/helm-values/nzbget_values.yaml b/helm-values/nzbget_values.yaml
index 2d17f4b..e52e620 100644
--- a/helm-values/nzbget_values.yaml
+++ b/helm-values/nzbget_values.yaml
@@ -22,6 +22,20 @@ env:
     value: "http://gluetun.default.svc.cluster.local:8888"
   - name: NO_PROXY
     value: "localhost,127.0.0.1,.svc,.cluster.local"
+  # Newshosting usenet provider credentials, sourced from the out-of-band
+  # `usenet-creds` Secret (not in git, same pattern as gluetun-wireguard).
+  # Referenced in nzbget.conf as ${NEWSHOSTING_USER} / ${NEWSHOSTING_PASS}
+  # so the password never lives in plaintext in the config file.
+  - name: NEWSHOSTING_USER
+    valueFrom:
+      secretKeyRef:
+        name: usenet-creds
+        key: NEWSHOSTING_USER
+  - name: NEWSHOSTING_PASS
+    valueFrom:
+      secretKeyRef:
+        name: usenet-creds
+        key: NEWSHOSTING_PASS
 
 service:
   type: ClusterIP