diff --git a/charts/oci-pivot-controller/templates/deployment.yaml b/charts/oci-pivot-controller/templates/deployment.yaml
index 1ace713..f8e92c9 100644
--- a/charts/oci-pivot-controller/templates/deployment.yaml
+++ b/charts/oci-pivot-controller/templates/deployment.yaml
@@ -33,6 +33,10 @@ spec:
             {{- if .Values.oci.compartmentId }}
             - --compartment-id={{ .Values.oci.compartmentId }}
             {{- end }}
+          {{- with .Values.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /healthz
diff --git a/charts/oci-pivot-controller/values.yaml b/charts/oci-pivot-controller/values.yaml
index eba3eb3..849b97c 100644
--- a/charts/oci-pivot-controller/values.yaml
+++ b/charts/oci-pivot-controller/values.yaml
@@ -12,10 +12,19 @@ replicaCount: 1
 oci:
   # OCI compartment OCID used when creating secondary private IPs and reserved public IPs.
   # Can be overridden per-resource via PivotIP.spec.compartmentId.
+  # Prefer extraEnvFrom + OCI_COMPARTMENT_ID over this when the value
+  # shouldn't be a plain Helm value (e.g. sourced from an External Secret).
   compartmentId: ""
 
 leaderElect: false
 
+# Extra envFrom entries on the manager container, e.g. to source
+# OCI_COMPARTMENT_ID from a Secret instead of oci.compartmentId above:
+#   extraEnvFrom:
+#     - secretRef:
+#         name: oci-pivot-controller-config
+extraEnvFrom: []
+
 resources:
   requests:
     cpu: 100m
diff --git a/cmd/main.go b/cmd/main.go
index c5fb4c7..373e2ec 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -81,9 +81,11 @@ func main() {
 	flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.")
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	flag.StringVar(&compartmentID, "compartment-id", "",
+	flag.StringVar(&compartmentID, "compartment-id", os.Getenv("OCI_COMPARTMENT_ID"),
 		"OCI compartment OCID used when creating secondary private IPs and reserved public IPs. "+
-			"Can be overridden per-resource via PivotIP.spec.compartmentId.")
+			"Can be overridden per-resource via PivotIP.spec.compartmentId. Falls back to the "+
+			"OCI_COMPARTMENT_ID env var when unset, so it can be sourced from a Secret rather "+
+			"than a Helm value.")
 	opts := zap.Options{
 		Development: true,
 	}