diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/certificate.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/certificate.yaml
index 3f20ffc..c8d40da 100644
--- a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/certificate.yaml
+++ b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/certificate.yaml
@@ -6,6 +6,8 @@ kind: Certificate
 metadata:
   name: root-ca-cert
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   isCA: true
 ---
@@ -14,6 +16,8 @@ kind: Certificate
 metadata:
   name: inter-ca-cert
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   caRef:
     name: root-ca-cert
@@ -27,6 +31,8 @@ kind: Secret
 metadata:
   name: inter-ca-cert
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 type: Opaque
 stringData:
   crt.pem: #@ data.values.tp.ingress.tls.certificate
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/password.yml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/password.yml
index 3f83a4a..ef21e12 100644
--- a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/password.yml
+++ b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/password.yml
@@ -5,6 +5,8 @@ kind: Password
 metadata:
   name: tp-pass
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -20,6 +22,8 @@ kind: Password
 metadata:
   name: redis-pass
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -35,6 +39,8 @@ kind: Password
 metadata:
   name: clickhouse-pass
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -50,6 +56,8 @@ kind: Password
 metadata:
   name: postgres-pass
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -65,6 +73,8 @@ kind: Password
 metadata:
   name: seaweed-access-key
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -80,6 +90,8 @@ kind: Password
 metadata:
   name: seaweed-readonly-access-key
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -95,6 +107,8 @@ kind: Password
 metadata:
   name: seaweed-secret-key
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 40
   digits: 10
@@ -110,6 +124,8 @@ kind: Password
 metadata:
   name: seaweed-readonly-secret-key
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 40
   digits: 10
@@ -125,6 +141,8 @@ kind: Password
 metadata:
   name: organization-id
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 36
   secretTemplate:
@@ -137,6 +155,8 @@ kind: Password
 metadata:
   name: encryption-key
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 44
   secretTemplate:
@@ -149,6 +169,8 @@ kind: Password
 metadata:
   name: tp-app-pass
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
@@ -164,6 +186,8 @@ kind: Password
 metadata:
   name: ensemble-user-service-pass
   namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 spec:
   length: 20
   digits: 5
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/rsa.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/rsa.yaml
index a676683..a1eb544 100644
--- a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/rsa.yaml
+++ b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/secretgen/rsa.yaml
@@ -5,10 +5,13 @@ kind: RSAKey
 metadata:
   name: rsa-key
   namespace: #@ data.values.tp.namespace
----
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
 ---
 apiVersion: secretgen.k14s.io/v1alpha1
 kind: RSAKey
 metadata:
   name: jwt-key
-  namespace: #@ data.values.tp.namespace
\ No newline at end of file
+  namespace: #@ data.values.tp.namespace
+  annotations:
+    kapp.k14s.io/change-group: "secrettemplate"
\ No newline at end of file