diff --git a/stdlib/kubernetes/helm/helm.cue b/stdlib/kubernetes/helm/helm.cue
index bf0bca88..a35d9122 100644
--- a/stdlib/kubernetes/helm/helm.cue
+++ b/stdlib/kubernetes/helm/helm.cue
@@ -13,47 +13,47 @@ import (
 #Chart: {
 
 	// Helm deployment name
-	name: string @dagger(input)
+	name: dagger.#Input & {string}
 
 	// Helm chart to install from source
-	chartSource?: dagger.#Artifact @dagger(input)
+	chartSource: *null | dagger.#Artifact
 
 	// Helm chart to install from repository
-	chart?: string @dagger(input)
+	chart: dagger.#Input & {*null | string}
 
 	// Helm chart repository
-	repository?: string @dagger(input)
+	repository: dagger.#Input & {string}
 
 	// Helm values (either a YAML string or a Cue structure)
-	values?: string @dagger(input)
+	values: dagger.#Input & {string}
 
 	// Kubernetes Namespace to deploy to
-	namespace: string @dagger(input)
+	namespace: dagger.#Input & {string}
 
 	// Helm action to apply
-	action: *"installOrUpgrade" | "install" | "upgrade" @dagger(input)
+	action: dagger.#Input & {*"installOrUpgrade" | "install" | "upgrade"}
 
 	// time to wait for any individual Kubernetes operation (like Jobs for hooks)
-	timeout: string | *"5m" @dagger(input)
+	timeout: dagger.#Input & {string | *"5m"}
 
 	// if set, will wait until all Pods, PVCs, Services, and minimum number of
 	// Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state
 	// before marking the release as successful.
 	// It will wait for as long as timeout
-	wait: *true | bool @dagger(input)
+	wait: dagger.#Input & {*true | bool}
 
 	// if set, installation process purges chart on fail.
 	// The wait option will be set automatically if atomic is used
-	atomic: *true | bool @dagger(input)
+	atomic: dagger.#Input & {*true | bool}
 
 	// Kube config file
-	kubeconfig: string @dagger(input)
+	kubeconfig: dagger.#Input & {string | dagger.#Secret}
 
 	// Helm version
-	version: *"3.5.2" | string @dagger(input)
+	version: dagger.#Input & {*"3.5.2" | string}
 
 	// Kubectl version
-	kubectlVersion: *"v1.19.9" | string @dagger(input)
+	kubectlVersion: dagger.#Input & {*"v1.19.9" | string}
 
 	#up: [
 		op.#Load & {
@@ -86,11 +86,15 @@ import (
 			dest:    "/entrypoint.sh"
 			content: #code
 		},
-		op.#WriteFile & {
-			dest:    "/kubeconfig"
-			content: kubeconfig
-			mode:    0o600
+
+		if (kubeconfig & string) != _|_ {
+			op.#WriteFile & {
+				dest:    "/kubeconfig"
+				content: kubeconfig
+				mode:    0o600
+			}
 		},
+
 		if chart != _|_ {
 			op.#WriteFile & {
 				dest:    "/helm/chart"
@@ -130,6 +134,9 @@ import (
 				if chartSource != _|_ && chart == _|_ {
 					"/helm/chart": from: chartSource
 				}
+				if (kubeconfig & dagger.#Secret) != _|_ {
+					"/kubeconfig": secret: kubeconfig
+				}
 			}
 		},
 	]