diff --git a/docs/reference/argocd.md b/docs/reference/argocd.md
index 11264085..53ddf353 100644
--- a/docs/reference/argocd.md
+++ b/docs/reference/argocd.md
@@ -21,7 +21,7 @@ Create an ArgoCD application
 |*config.version*          | `*"v2.0.5" \| string`                            |ArgoCD CLI binary version       |
 |*config.server*           | `string`                                         |ArgoCD server                   |
 |*config.project*          | `*"default" \| string`                           |ArgoCD project                  |
-|*config.token*            | `*null \| {}`                                    |ArgoCD authentication token     |
+|*config.token*            | `*null \| {\n                                    $dagger: {\n                         secret: {}\n    }\n}`    |ArgoCD authentication token    |
 |*name*                    | `string`                                         |App name                        |
 |*repo*                    | `string`                                         |Repository url (git or helm)    |
 |*path*                    | `string`                                         |Folder to deploy                |
@@ -29,7 +29,7 @@ Create an ArgoCD application
 |*image.config.version*    | `*"v2.0.5" \| string`                            |ArgoCD CLI binary version       |
 |*image.config.server*     | `string`                                         |ArgoCD server                   |
 |*image.config.project*    | `*"default" \| string`                           |ArgoCD project                  |
-|*image.config.token*      | `*null \| {}`                                    |ArgoCD authentication token     |
+|*image.config.token*      | `*null \| {\n                                    $dagger: {\n                         secret: {}\n    }\n}`    |ArgoCD authentication token    |
 |*namespace*               | `*"default" \| string`                           |Destination namespace           |
 |*env.APP_NAME*            | `string`                                         |-                               |
 |*env.APP_REPO*            | `string`                                         |-                               |
@@ -47,12 +47,12 @@ Re-usable CLI component
 
 ### argocd.#CLI Inputs
 
-| Name               | Type                      | Description                   |
-| -------------      |:-------------:            |:-------------:                |
-|*config.version*    | `*"v2.0.5" \| string`     |ArgoCD CLI binary version      |
-|*config.server*     | `string`                  |ArgoCD server                  |
-|*config.project*    | `*"default" \| string`    |ArgoCD project                 |
-|*config.token*      | `*null \| {}`             |ArgoCD authentication token    |
+| Name               | Type                      | Description                 |
+| -------------      |:-------------:            |:-------------:              |
+|*config.version*    | `*"v2.0.5" \| string`     |ArgoCD CLI binary version    |
+|*config.server*     | `string`                  |ArgoCD server                |
+|*config.project*    | `*"default" \| string`    |ArgoCD project               |
+|*config.token*      | `*null \| {\n             $dagger: {\n                      secret: {}\n    }\n}`    |ArgoCD authentication token    |
 
 ### argocd.#CLI Outputs
 
@@ -64,12 +64,12 @@ ArgoCD configuration
 
 ### argocd.#Config Inputs
 
-| Name             | Type                      | Description                   |
-| -------------    |:-------------:            |:-------------:                |
-|*version*         | `*"v2.0.5" \| string`     |ArgoCD CLI binary version      |
-|*server*          | `string`                  |ArgoCD server                  |
-|*project*         | `*"default" \| string`    |ArgoCD project                 |
-|*token*           | `*null \| {}`             |ArgoCD authentication token    |
+| Name             | Type                      | Description                 |
+| -------------    |:-------------:            |:-------------:              |
+|*version*         | `*"v2.0.5" \| string`     |ArgoCD CLI binary version    |
+|*server*          | `string`                  |ArgoCD server                |
+|*project*         | `*"default" \| string`    |ArgoCD project               |
+|*token*           | `*null \| {\n             $dagger: {\n                      secret: {}\n    }\n}`    |ArgoCD authentication token    |
 
 ### argocd.#Config Outputs
 
@@ -81,13 +81,13 @@ Get application's status
 
 ### argocd.#Status Inputs
 
-| Name               | Type                      | Description                   |
-| -------------      |:-------------:            |:-------------:                |
-|*config.version*    | `*"v2.0.5" \| string`     |ArgoCD CLI binary version      |
-|*config.server*     | `string`                  |ArgoCD server                  |
-|*config.project*    | `*"default" \| string`    |ArgoCD project                 |
-|*config.token*      | `*null \| {}`             |ArgoCD authentication token    |
-|*name*              | `string`                  |ArgoCD application             |
+| Name               | Type                      | Description                 |
+| -------------      |:-------------:            |:-------------:              |
+|*config.version*    | `*"v2.0.5" \| string`     |ArgoCD CLI binary version    |
+|*config.server*     | `string`                  |ArgoCD server                |
+|*config.project*    | `*"default" \| string`    |ArgoCD project               |
+|*config.token*      | `*null \| {\n             $dagger: {\n                      secret: {}\n    }\n}`    |ArgoCD authentication token    |
+|*name*              | `string`                  |ArgoCD application           |
 
 ### argocd.#Status Outputs
 
@@ -111,18 +111,18 @@ Sync an application to its targer state
 |*config.version*              | `*"v2.0.5" \| string`     |ArgoCD CLI binary version                 |
 |*config.server*               | `string`                  |ArgoCD server                             |
 |*config.project*              | `*"default" \| string`    |ArgoCD project                            |
-|*config.token*                | `*null \| {}`             |ArgoCD authentication token               |
+|*config.token*                | `*null \| {\n             $dagger: {\n                                   secret: {}\n    }\n}`    |ArgoCD authentication token    |
 |*application*                 | `string`                  |ArgoCD application                        |
 |*wait*                        | `*false \| bool`          |Wait the application to sync correctly    |
 |*ctr.image.config.version*    | `*"v2.0.5" \| string`     |ArgoCD CLI binary version                 |
 |*ctr.image.config.server*     | `string`                  |ArgoCD server                             |
 |*ctr.image.config.project*    | `*"default" \| string`    |ArgoCD project                            |
-|*ctr.image.config.token*      | `*null \| {}`             |ArgoCD authentication token               |
+|*ctr.image.config.token*      | `*null \| {\n             $dagger: {\n                                   secret: {}\n    }\n}`    |ArgoCD authentication token    |
 |*ctr.env.APPLICATION*         | `string`                  |-                                         |
 |*status.config.version*       | `*"v2.0.5" \| string`     |ArgoCD CLI binary version                 |
 |*status.config.server*        | `string`                  |ArgoCD server                             |
 |*status.config.project*       | `*"default" \| string`    |ArgoCD project                            |
-|*status.config.token*         | `*null \| {}`             |ArgoCD authentication token               |
+|*status.config.token*         | `*null \| {\n             $dagger: {\n                                   secret: {}\n    }\n}`    |ArgoCD authentication token    |
 |*status.name*                 | `string`                  |ArgoCD application                        |
 
 ### argocd.#Sync Outputs
diff --git a/docs/reference/git.md b/docs/reference/git.md
index bb0d9bfa..ae6e60a2 100644
--- a/docs/reference/git.md
+++ b/docs/reference/git.md
@@ -16,15 +16,15 @@ Commit & push to git repository
 
 ### git.#Commit Inputs
 
-| Name                     | Type                | Description                              |
-| -------------            |:-------------:      |:-------------:                           |
-|*repository.remote*       | `string`            |Repository remote URL                     |
-|*repository.authToken*    | `*null \| {}`       |Authentication token (PAT or password)    |
-|*repository.branch*       | `string`            |Git branch                                |
-|*name*                    | `string`            |Username                                  |
-|*email*                   | `string`            |Email                                     |
-|*message*                 | `string`            |Commit message                            |
-|*force*                   | `*false \| bool`    |Force push options                        |
+| Name                     | Type                | Description             |
+| -------------            |:-------------:      |:-------------:          |
+|*repository.remote*       | `string`            |Repository remote URL    |
+|*repository.authToken*    | `*null \| {\n       $dagger: {\n                  secret: {}\n    }\n}`    |Authentication token (PAT or password)    |
+|*repository.branch*       | `string`            |Git branch               |
+|*name*                    | `string`            |Username                 |
+|*email*                   | `string`            |Email                    |
+|*message*                 | `string`            |Commit message           |
+|*force*                   | `*false \| bool`    |Force push options       |
 
 ### git.#Commit Outputs
 
@@ -69,8 +69,8 @@ A git repository
 |*remote*          | `string`             |Git remote link                                             |
 |*ref*             | `string`             |Git ref: can be a commit, tag or branch. Example: "main"    |
 |*subdir*          | `*null \| string`    |(optional) Subdirectory                                     |
-|*authToken*       | `*null \| {}`        |(optional) Add Personal Access Token                        |
-|*authHeader*      | `*null \| {}`        |(optional) Add OAuth Token                                  |
+|*authToken*       | `*null \| {\n        $dagger: {\n                                                     secret: {}\n    }\n}`    |(optional) Add Personal Access Token    |
+|*authHeader*      | `*null \| {\n        $dagger: {\n                                                     secret: {}\n    }\n}`    |(optional) Add OAuth Token              |
 
 ### git.#Repository Outputs
 
diff --git a/plancontext/fs.go b/plancontext/fs.go
index 4d3bef88..fd094724 100644
--- a/plancontext/fs.go
+++ b/plancontext/fs.go
@@ -13,8 +13,9 @@ import (
 
 var (
 	fsIDPath = cue.MakePath(
-		cue.Hid("_fs", stdlib.EnginePackage),
-		cue.Str("id"),
+		cue.Str("$dagger"),
+		cue.Str("fs"),
+		cue.Hid("_id", stdlib.EnginePackage),
 	)
 )
 
diff --git a/plancontext/secret.go b/plancontext/secret.go
index 7e7d0ad3..e2e3a136 100644
--- a/plancontext/secret.go
+++ b/plancontext/secret.go
@@ -11,8 +11,9 @@ import (
 
 var (
 	secretIDPath = cue.MakePath(
-		cue.Hid("_secret", stdlib.EnginePackage),
-		cue.Str("id"),
+		cue.Str("$dagger"),
+		cue.Str("secret"),
+		cue.Hid("_id", stdlib.EnginePackage),
 	)
 )
 
diff --git a/plancontext/service.go b/plancontext/service.go
index 33561e54..1bcc0cd7 100644
--- a/plancontext/service.go
+++ b/plancontext/service.go
@@ -11,8 +11,9 @@ import (
 
 var (
 	serviceIDPath = cue.MakePath(
-		cue.Hid("_service", stdlib.EnginePackage),
-		cue.Str("id"),
+		cue.Str("$dagger"),
+		cue.Str("service"),
+		cue.Hid("_id", stdlib.EnginePackage),
 	)
 )
 
diff --git a/stdlib/europa/dagger/engine/types.cue b/stdlib/europa/dagger/engine/types.cue
index 5a0a2c27..7296f3fb 100644
--- a/stdlib/europa/dagger/engine/types.cue
+++ b/stdlib/europa/dagger/engine/types.cue
@@ -7,7 +7,7 @@ package engine
 //  - A directory containing binary artifacts
 // Rule of thumb: if it fits in a tar archive, it fits in a #FS.
 #FS: {
-	_fs: id: string
+	$dagger: fs: _id: string
 }
 
 // A reference to an external secret, for example:
@@ -17,7 +17,7 @@ package engine
 // Secrets are never merged in the Cue tree. They can only be used
 // by a special filesystem mount designed to minimize leak risk.
 #Secret: {
-	_secret: id: string
+	$dagger: secret: _id: string
 }
 
 // A reference to a network service endpoint, for example:
@@ -25,5 +25,5 @@ package engine
 //  - A unix or npipe socket
 //  - An HTTPS endpoint
 #Service: {
-	_service: id: string
+	$dagger: service: _id: string
 }