diff --git a/.gitignore b/.gitignore
index fe8f26c4..282ce7fa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,7 @@ npm-debug.log
 # Dialyzer PLT files
 /priv/plts/
 
+# Environment variables (used by direnv and Kustomize secretGenerator)
+.envrc
+k8s/.envrc
+
diff --git a/config/runtime.exs b/config/runtime.exs
index 1aced7a9..df56f943 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -59,27 +59,6 @@ if config_env() == :prod do
       ]
     ]
 
-  config :towerops, Towerops.Repo,
-    # ssl: true,
-    url: database_url,
-    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
-    # For machines with several cores, consider starting multiple pools of `pool_size`
-    # pool_count: 4,
-    socket_options: maybe_ipv6
-
-  config :towerops, ToweropsWeb.Endpoint,
-    url: [host: host, port: 443, scheme: "https"],
-    http: [
-      # Enable IPv6 and bind on all interfaces.
-      # Set it to  {0, 0, 0, 0, 0, 0, 0, 1} for local network only access.
-      # See the documentation on https://hexdocs.pm/bandit/Bandit.html#t:options/0
-      # for details about using IPv6 vs IPv4 and loopback vs public addresses.
-      ip: {0, 0, 0, 0, 0, 0, 0, 0}
-    ],
-    secret_key_base: secret_key_base
-
-  config :towerops, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
-
   # ## SSL Support
   #
   # To get SSL working, you will need to add the `https` key
@@ -129,4 +108,30 @@ if config_env() == :prod do
   #     config :swoosh, :api_client, Swoosh.ApiClient.Req
   #
   # See https://hexdocs.pm/swoosh/Swoosh.html#module-installation for details.
+
+  # Configure SendGrid for production email
+  config :towerops, Towerops.Mailer,
+    adapter: Swoosh.Adapters.Sendgrid,
+    api_key: System.get_env("SENDGRID_API_KEY")
+
+  config :towerops, Towerops.Repo,
+    # ssl: true,
+    url: database_url,
+    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
+    # For machines with several cores, consider starting multiple pools of `pool_size`
+    # pool_count: 4,
+    socket_options: maybe_ipv6
+
+  config :towerops, ToweropsWeb.Endpoint,
+    url: [host: host, port: 443, scheme: "https"],
+    http: [
+      # Enable IPv6 and bind on all interfaces.
+      # Set it to  {0, 0, 0, 0, 0, 0, 0, 1} for local network only access.
+      # See the documentation on https://hexdocs.pm/bandit/Bandit.html#t:options/0
+      # for details about using IPv6 vs IPv4 and loopback vs public addresses.
+      ip: {0, 0, 0, 0, 0, 0, 0, 0}
+    ],
+    secret_key_base: secret_key_base
+
+  config :towerops, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
 end
diff --git a/k8s/README.md b/k8s/README.md
new file mode 100644
index 00000000..e27d7ab4
--- /dev/null
+++ b/k8s/README.md
@@ -0,0 +1,38 @@
+# Kubernetes Deployment
+
+## Secrets Management
+
+Secrets are stored in `.envrc` files (gitignored):
+- Project root `.envrc` - Used by direnv for local development
+- `k8s/.envrc` - Used by Kustomize for secret generation
+
+Kustomize automatically generates the `towerops-sendgrid` Secret from `k8s/.envrc` using the `secretGenerator` in `kustomization.yaml`.
+
+Both `.envrc` files should contain:
+```bash
+# SendGrid Configuration
+SENDGRID_API_KEY=your-api-key-here
+export SENDGRID_API_KEY
+```
+
+The KEY=VALUE format works for both Kustomize and direnv.
+
+## Deploying
+
+Apply all resources using kustomize:
+
+```bash
+kubectl apply -k k8s/
+```
+
+Or individually:
+
+```bash
+kubectl apply -f k8s/namespace.yaml
+kubectl apply -f k8s/secret.yaml
+kubectl apply -f k8s/deployment.yaml
+kubectl apply -f k8s/service.yaml
+kubectl apply -f k8s/service-headless.yaml
+kubectl apply -f k8s/certificate.yaml
+kubectl apply -f k8s/ingressroute.yaml
+```
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 45eb8a98..a99dc0df 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -60,6 +60,11 @@ spec:
             secretKeyRef:
               name: towerops-secrets
               key: SECRET_KEY_BASE
+        - name: SENDGRID_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: towerops-sendgrid
+              key: SENDGRID_API_KEY
         envFrom:
         - secretRef:
             name: towerops-db
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 37dff34c..d4b2e517 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -8,3 +8,10 @@ resources:
   - service-headless.yaml
   - certificate.yaml
   - ingressroute.yaml
+
+secretGenerator:
+  - name: towerops-sendgrid
+    envs:
+      - .envrc
+    options:
+      disableNameSuffixHash: true