diff --git a/charts/patchmon/Chart.yaml b/charts/patchmon/Chart.yaml
index 881ff3c..1edb800 100644
--- a/charts/patchmon/Chart.yaml
+++ b/charts/patchmon/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: patchmon
 description: PatchMon v2 – Linux patch management platform with optional Gateway API, Postgres, Valkey, and Guacd
 type: application
-version: 0.3.6
+version: 0.3.7
 appVersion: "2.1.3"
 
 maintainers:
diff --git a/charts/patchmon/templates/secret.yaml b/charts/patchmon/templates/secret.yaml
index 0bdf592..4fd1668 100644
--- a/charts/patchmon/templates/secret.yaml
+++ b/charts/patchmon/templates/secret.yaml
@@ -30,6 +30,18 @@
 {{- $oldOidc = (index (index $s "data") "OIDC_CLIENT_SECRET") | b64dec -}}
 {{- end -}}
 
+{{- /*
+  Read the pinnable secrets with `dig` rather than a direct path. `helm upgrade
+  --reuse-values` substitutes the previous release's values for the incoming
+  chart's defaults instead of merging them, so a release created before these
+  keys existed has no `patchmon.session` / `patchmon.encryption` map at all and
+  a direct `.Values.patchmon.session.secret` fails to render with
+  "nil pointer evaluating interface {}.secret".
+*/ -}}
+{{- $jwtVal := dig "jwt" "secret" "" .Values.patchmon -}}
+{{- $sessionVal := dig "session" "secret" "" .Values.patchmon -}}
+{{- $aiKeyVal := dig "encryption" "aiKey" "" .Values.patchmon -}}
+
 apiVersion: v1
 kind: Secret
 metadata:
@@ -41,9 +53,9 @@ stringData:
 {{- if and (eq .Values.database.mode "internal") (not .Values.postgres.auth.existingSecret) }}
   POSTGRES_PASSWORD: {{ default (randAlphaNum 32) $oldPg | quote }}
 {{- end }}
-  JWT_SECRET: {{ default (randAlphaNum 64) (default $oldJwt .Values.patchmon.jwt.secret) | quote }}
-  SESSION_SECRET: {{ default (randAlphaNum 64) (default $oldSession .Values.patchmon.session.secret) | quote }}
-  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey .Values.patchmon.encryption.aiKey) | quote }}
+  JWT_SECRET: {{ default (randAlphaNum 64) (default $oldJwt $jwtVal) | quote }}
+  SESSION_SECRET: {{ default (randAlphaNum 64) (default $oldSession $sessionVal) | quote }}
+  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey $aiKeyVal) | quote }}
 {{- if .Values.valkey.auth.enabled }}
   REDIS_PASSWORD: {{ default (randAlphaNum 32) $oldRedis | quote }}
 {{- end }}