diff --git a/terraform/k8sapps/config.tf b/terraform/k8sapps/config.tf
index c226192..1a474d9 100644
--- a/terraform/k8sapps/config.tf
+++ b/terraform/k8sapps/config.tf
@@ -39,6 +39,7 @@ locals {
 
   # rustdesk
   rustdesk_version = "latest"
+  rustdesk_fqdn    = "rustdesk.alexpires.me"
 
   # backup
   local_backup_retention_days = 2
diff --git a/terraform/k8sapps/rustdesk.tf b/terraform/k8sapps/rustdesk.tf
index 5613b77..01b0c30 100644
--- a/terraform/k8sapps/rustdesk.tf
+++ b/terraform/k8sapps/rustdesk.tf
@@ -15,7 +15,7 @@ resource "kubernetes_config_map" "rustdesk_config" {
   }
 
   data = {
-    RELAY          = "rustdesk.alexpires.me"
+    RELAY          = local.rustdesk_fqdn
     ENCRYPTED_ONLY = "1"
   }
 }
@@ -27,14 +27,14 @@ resource "kubernetes_secret" "rustdesk_keys" {
   }
 
   data = {
-    KEY_PRIV = var.rustdesk_private_key
-    KEY_PUB  = var.rustdesk_public_key
+    "id_ed25519"     = var.rustdesk_private_key
+    "id_ed25519.pub" = var.rustdesk_public_key
   }
 }
 
 resource "kubernetes_deployment" "rustdesk_deploy" {
   metadata {
-    name      = "rustdesk-deploy"
+    name      = "rustdesk"
     namespace = kubernetes_namespace.rustdesk.metadata[0].name
     labels = {
       app = "rustdesk-app"
@@ -68,16 +68,6 @@ resource "kubernetes_deployment" "rustdesk_deploy" {
             }
           }
 
-          env {
-            name  = "KEY_PRIV"
-            value = kubernetes_secret.rustdesk_keys.data["KEY_PRIV"]
-          }
-
-          env {
-            name  = "KEY_PUB"
-            value = kubernetes_secret.rustdesk_keys.data["KEY_PUB"]
-          }
-
           security_context {
             allow_privilege_escalation = false
           }
@@ -114,6 +104,20 @@ resource "kubernetes_deployment" "rustdesk_deploy" {
             name       = "rustdesk-data"
             mount_path = "/data"
           }
+
+          volume_mount {
+            name       = "rust-keys"
+            mount_path = "/data/id_ed25519"
+            sub_path   = "id_ed25519"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "rust-keys"
+            mount_path = "/data/id_ed25519.pub"
+            sub_path   = "id_ed25519.pub"
+            read_only  = true
+          }
         }
 
         volume {
@@ -122,6 +126,13 @@ resource "kubernetes_deployment" "rustdesk_deploy" {
             path = local.rustdesk_path
           }
         }
+
+        volume {
+          name = "rust-keys"
+          secret {
+            secret_name = kubernetes_secret.rustdesk_keys.metadata[0].name
+          }
+        }
       }
     }
   }
@@ -158,6 +169,13 @@ resource "kubernetes_service" "rustdesk_tcp_ports" {
 
     type = "LoadBalancer"
   }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+
 }
 
 resource "kubernetes_service" "rustdesk_udp_ports" {
@@ -180,4 +198,10 @@ resource "kubernetes_service" "rustdesk_udp_ports" {
 
     type = "LoadBalancer"
   }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
 }