diff --git a/platform/global-secrets/templates/secret-generator/cronjob.yaml b/platform/global-secrets/templates/secret-generator/cronjob.yaml
deleted file mode 100644
index dd14f17f..00000000
--- a/platform/global-secrets/templates/secret-generator/cronjob.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: secret-generator
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    argocd.argoproj.io/sync-wave: '1'
-spec:
-  schedule: '*/5 * * * *'
-  concurrencyPolicy: Forbid
-  jobTemplate:
-    spec:
-      backoffLimit: 3
-      template:
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: apply
-              image: golang:1.19-alpine
-              workingDir: /go/src/secret-generator
-              command:
-                - sh
-                - -c
-              args:
-                - |
-                  go get .
-                  go run .
-              volumeMounts:
-                - name: source
-                  mountPath: /go/src/secret-generator
-          serviceAccount: secret-generator
-          volumes:
-            - name: source
-              configMap:
-                name: secret-generator
diff --git a/platform/global-secrets/templates/secret-generator/job.yaml b/platform/global-secrets/templates/secret-generator/job.yaml
new file mode 100644
index 00000000..c3689147
--- /dev/null
+++ b/platform/global-secrets/templates/secret-generator/job.yaml
@@ -0,0 +1,29 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: secret-generator-{{ include (print $.Template.BasePath "/secret-generator/configmap.yaml") . | sha256sum | trunc 7 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: secret-generator
+          image: golang:1.19-alpine
+          workingDir: /go/src/secret-generator
+          command:
+            - sh
+            - -c
+          args:
+            - |
+              go get .
+              go run .
+          volumeMounts:
+            - name: source
+              mountPath: /go/src/secret-generator
+      serviceAccount: secret-generator
+      volumes:
+        - name: source
+          configMap:
+            name: secret-generator