diff --git a/charts/mok/Chart.yaml b/charts/mok/Chart.yaml
index 39a06c2a47475a56bfcf5d43596e6fa1598fcc01..87bf6ee3483aef6aacf40cde0fc27f891b4f82eb 100644
--- a/charts/mok/Chart.yaml
+++ b/charts/mok/Chart.yaml
@@ -3,7 +3,7 @@ name: mok
 description: |
   Mail on Kubernetes (MoK) is a project to deploy a functional mailserver that runs without a database server on Kubernetes, taking advantage of configmaps and secret.
 type: application
-version: 0.1.3
+version: 0.2.0
 sources:
   - https://de.postfix.org/ftpmirror/index.html
   - https://github.com/dovecot/core
diff --git a/charts/mok/README.md b/charts/mok/README.md
index aad2ed006b76ccfc03b7ce2d3f9f8804e638c464..859672563f7c483ffcadb532454ecbfbbee5649d 100644
--- a/charts/mok/README.md
+++ b/charts/mok/README.md
@@ -1,6 +1,6 @@
 # mok
 
-![Version: 0.1.3](https://img.shields.io/badge/Version-0.1.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Mail on Kubernetes (MoK) is a project to deploy a functional mailserver that runs without a database server on Kubernetes, taking advantage of configmaps and secret.
 
diff --git a/charts/mok/templates/dovecot.yaml b/charts/mok/templates/dovecot.yaml
index 30d4c0ce33217e2cff8c21d308732b5c0970fc94..d15829c1180c905a061360e14570908483df1e4d 100644
--- a/charts/mok/templates/dovecot.yaml
+++ b/charts/mok/templates/dovecot.yaml
@@ -69,10 +69,11 @@ spec:
       labels:
         {{- include "mok.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: dovecot
-      {{- with .Values.dovecot.podAnnotations }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- with .Values.dovecot.podAnnotations }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
     spec:
       {{- with .Values.dovecot.imagePullSecrets }}
       imagePullSecrets:
diff --git a/charts/mok/templates/postfix.yaml b/charts/mok/templates/postfix.yaml
index 29da5d20ec4a7dae0ce074b20a083402298f1280..c22e9ddf101a547742b59f8404ef7004e525475a 100644
--- a/charts/mok/templates/postfix.yaml
+++ b/charts/mok/templates/postfix.yaml
@@ -49,10 +49,11 @@ spec:
   {{- end }}
   template:
     metadata:
-      {{- with .Values.postfix.podAnnotations }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- with .Values.postfix.podAnnotations }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
       labels:
         {{- include "mok.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: postfix
diff --git a/charts/mok/tests/__snapshot__/domains_test.yaml.snap b/charts/mok/tests/__snapshot__/domains_test.yaml.snap
index dd167134a8a5a8d20261a38762659ec147555cef..9d7264b7ed8484632fae926bcc3c93f257efd0e0 100644
--- a/charts/mok/tests/__snapshot__/domains_test.yaml.snap
+++ b/charts/mok/tests/__snapshot__/domains_test.yaml.snap
@@ -8,7 +8,7 @@ keeps stays the same:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot-users
     stringData:
       passwd: |
@@ -23,7 +23,7 @@ keeps stays the same:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-postfix-maps
     stringData:
       aliases: |
diff --git a/charts/mok/tests/__snapshot__/dovecot_test.yaml.snap b/charts/mok/tests/__snapshot__/dovecot_test.yaml.snap
index 302f30dac9a00550c1734e5ecbf2373d80655f84..c3b53ce133469640c0fe9c36b76077164a056bea 100644
--- a/charts/mok/tests/__snapshot__/dovecot_test.yaml.snap
+++ b/charts/mok/tests/__snapshot__/dovecot_test.yaml.snap
@@ -10,7 +10,7 @@ should match snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot
     spec:
       ports:
@@ -43,7 +43,7 @@ should match snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot-internal
     spec:
       ports:
@@ -67,7 +67,7 @@ should match snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot
     spec:
       replicas: 1
@@ -80,6 +80,8 @@ should match snapshot:
         type: Recreate
       template:
         metadata:
+          annotations:
+            checksum/config: 1ccde744f84d15a511177495e8197c3e895b1077c3e180da583ea4d8a3202332
           labels:
             app.kubernetes.io/component: dovecot
             app.kubernetes.io/instance: RELEASE-NAME
@@ -157,7 +159,7 @@ should match snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot-vmail
     spec:
       accessModes:
@@ -166,3 +168,37 @@ should match snapshot:
         requests:
           storage: 5Gi
       volumeMode: Filesystem
+  5: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      labels:
+        app.kubernetes.io/component: dovecot
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: mok
+        helm.sh/chart: mok-0.2.0
+      name: RELEASE-NAME-mok-dovecot-users
+    stringData:
+      passwd: ""
+    type: Opaque
+  6: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      labels:
+        app.kubernetes.io/component: postfix
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: mok
+        helm.sh/chart: mok-0.2.0
+      name: RELEASE-NAME-mok-postfix-maps
+    stringData:
+      aliases: ""
+      domains: ""
+      mailboxes: ""
+      relayhosts: ""
+      sasl_passwd: ""
+      sender-login-maps: ""
+      tls-policies: ""
+    type: Opaque
diff --git a/charts/mok/tests/__snapshot__/networkpolicies_test.yaml.snap b/charts/mok/tests/__snapshot__/networkpolicies_test.yaml.snap
index 8f287edae41cad13dead41fc52e25b49cb6da73b..872a2068400a040b6a5059121089de022cc16517 100644
--- a/charts/mok/tests/__snapshot__/networkpolicies_test.yaml.snap
+++ b/charts/mok/tests/__snapshot__/networkpolicies_test.yaml.snap
@@ -8,7 +8,7 @@ matches snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot
     spec:
       ingress:
@@ -53,7 +53,7 @@ matches snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-postfix
     spec:
       ingress:
diff --git a/charts/mok/tests/__snapshot__/postfix_test.yaml.snap b/charts/mok/tests/__snapshot__/postfix_test.yaml.snap
index bfc1e2f7586c2250c9fa4e5ca8106bec15a5a271..0472fa11813cd7f435a4b0ab4954fa1b34db9436 100644
--- a/charts/mok/tests/__snapshot__/postfix_test.yaml.snap
+++ b/charts/mok/tests/__snapshot__/postfix_test.yaml.snap
@@ -10,7 +10,7 @@ should match snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-postfix
     spec:
       ports:
@@ -37,7 +37,7 @@ should match snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-postfix
     spec:
       replicas: 1
@@ -49,6 +49,8 @@ should match snapshot:
       serviceName: RELEASE-NAME-mok-postfix-statefulset
       template:
         metadata:
+          annotations:
+            checksum/config: 1ccde744f84d15a511177495e8197c3e895b1077c3e180da583ea4d8a3202332
           labels:
             app.kubernetes.io/component: postfix
             app.kubernetes.io/instance: RELEASE-NAME
@@ -156,3 +158,37 @@ should match snapshot:
           resources:
             requests:
               storage: 1Gi
+  3: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      labels:
+        app.kubernetes.io/component: dovecot
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: mok
+        helm.sh/chart: mok-0.2.0
+      name: RELEASE-NAME-mok-dovecot-users
+    stringData:
+      passwd: ""
+    type: Opaque
+  4: |
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      labels:
+        app.kubernetes.io/component: postfix
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: mok
+        helm.sh/chart: mok-0.2.0
+      name: RELEASE-NAME-mok-postfix-maps
+    stringData:
+      aliases: ""
+      domains: ""
+      mailboxes: ""
+      relayhosts: ""
+      sasl_passwd: ""
+      sender-login-maps: ""
+      tls-policies: ""
+    type: Opaque
diff --git a/charts/mok/tests/__snapshot__/relay_test.yaml.snap b/charts/mok/tests/__snapshot__/relay_test.yaml.snap
index 44590aaa57910890722b7566a01e1cf712ef0565..e4b2084c3d1f46c1a59232cb9869b4b8fa79932e 100644
--- a/charts/mok/tests/__snapshot__/relay_test.yaml.snap
+++ b/charts/mok/tests/__snapshot__/relay_test.yaml.snap
@@ -8,7 +8,7 @@ keeps stays the same:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-dovecot-users
     stringData:
       passwd: ""
@@ -22,7 +22,7 @@ keeps stays the same:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: mok
-        helm.sh/chart: mok-0.1.3
+        helm.sh/chart: mok-0.2.0
       name: RELEASE-NAME-mok-postfix-maps
     stringData:
       aliases: ""
diff --git a/charts/mok/tests/dovecot_test.yaml b/charts/mok/tests/dovecot_test.yaml
index bcd2d8452f768d49a908daf0faaff60c25c1e9a2..92314baaf31e3b05f8ee01aefebe80c5269f183c 100644
--- a/charts/mok/tests/dovecot_test.yaml
+++ b/charts/mok/tests/dovecot_test.yaml
@@ -2,6 +2,7 @@ suite: Dovecot
 templates:
   - dovecot.yaml
   - persistentvolumeclaim.yaml
+  - secret.yaml
 tests:
   - it: should match snapshot
     set:
@@ -83,3 +84,28 @@ tests:
             name: pop3s
         documentIndex: 2
         template: dovecot.yaml
+  - it: has config hash for auto-reload
+    set:
+      dovecot:
+        secretName: example-tls
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.[checksum/config]
+          value: 1ccde744f84d15a511177495e8197c3e895b1077c3e180da583ea4d8a3202332
+        documentIndex: 2
+        template: dovecot.yaml
+  - it: has a changing config hash for auto-reload
+    set:
+      dovecot:
+        secretName: example-tls
+      domains:
+        example.com:
+          users:
+            - name: test
+              passwordHash: NotReallyAHash
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.[checksum/config]
+          value: ac3f477cdba7cd408edee56403b1c480ab9765791edd3fdf9fe5f60cfe0b80e9
+        documentIndex: 2
+        template: dovecot.yaml
diff --git a/charts/mok/tests/postfix_test.yaml b/charts/mok/tests/postfix_test.yaml
index 3e38ee45c1a00fdbc4a47142e09c105e76ca1914..2246fefa87a82e993de81eef8076d07bbaccbd2e 100644
--- a/charts/mok/tests/postfix_test.yaml
+++ b/charts/mok/tests/postfix_test.yaml
@@ -1,6 +1,7 @@
 suite: Postfix
 templates:
   - postfix.yaml
+  - secret.yaml
 tests:
   - it: should match snapshot
     set:
@@ -20,10 +21,12 @@ tests:
       - isKind:
           of: Service
         documentIndex: 0
+        template: postfix.yaml
       - equal:
           path: metadata.name
           value: test-suite-mok-postfix
         documentIndex: 0
+        template: postfix.yaml
   - it: has smtp port
     set:
       postfix:
@@ -37,9 +40,36 @@ tests:
             name: smtp
             protocol: TCP
         documentIndex: 0
+        template: postfix.yaml
       - contains:
           path: spec.template.spec.containers[0].ports
           content:
             containerPort: 25
             name: smtp
         documentIndex: 1
+        template: postfix.yaml
+  - it: has config hash for auto-reload
+    set:
+      dovecot:
+        secretName: example-tls
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.[checksum/config]
+          value: 1ccde744f84d15a511177495e8197c3e895b1077c3e180da583ea4d8a3202332
+        documentIndex: 1
+        template: postfix.yaml
+  - it: has a changing config hash for auto-reload
+    set:
+      dovecot:
+        secretName: example-tls
+      domains:
+        example.com:
+          users:
+            - name: test
+              passwordHash: NotReallyAHash
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.[checksum/config]
+          value: ac3f477cdba7cd408edee56403b1c480ab9765791edd3fdf9fe5f60cfe0b80e9
+        documentIndex: 1
+        template: postfix.yaml