diff --git a/core/src/plugins/kubernetes/kubernetes-type/handlers.ts b/core/src/plugins/kubernetes/kubernetes-type/handlers.ts
index ac421fe4dd..a97a4c3369 100644
--- a/core/src/plugins/kubernetes/kubernetes-type/handlers.ts
+++ b/core/src/plugins/kubernetes/kubernetes-type/handlers.ts
@@ -40,6 +40,7 @@ import type { ActionMode, Resolved } from "../../../actions/types.js"
 import { deployStateToActionState } from "../../../plugin/handlers/Deploy/get-status.js"
 import type { ResolvedDeployAction } from "../../../actions/deploy.js"
 import { isSha256 } from "../../../util/hashing.js"
+import { prepareSecrets } from "../secrets.js"
 
 export const kubernetesHandlers: Partial<ModuleActionHandlers<KubernetesModule>> = {
   configure: configureKubernetesModule,
@@ -365,6 +366,10 @@ export const kubernetesDeploy: DeployActionHandler<"deploy", KubernetesDeployAct
 
   const manifests = await getManifests({ ctx, api, log, action, defaultNamespace: namespace })
 
+  // Ensure secrets are created in the target namespace
+  const secrets = [...provider.config.copySecrets, ...provider.config.imagePullSecrets]
+  await prepareSecrets({ api, namespace, secrets, log })
+
   // We separate out manifests for namespace resources, since we don't want to apply a prune selector
   // when applying them.
   const [namespaceManifests, otherManifests] = partition(manifests, (m) => m.kind === "Namespace")