diff --git a/tasks/main.yaml b/tasks/main.yaml
index 64947bf..0cd8172 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -2,7 +2,7 @@
 - name: Edit redis config on rhel9
   ansible.builtin.lineinfile:
     path: /etc/redis/redis.conf
-    regexp: '^bind '
+    regexp: "^bind "
     line: bind * -::*
   when: ansible_distribution_major_version == "9"
   notify:
@@ -11,7 +11,7 @@
 - name: Disable redis protected-mode on rhel9
   ansible.builtin.lineinfile:
     path: /etc/redis/redis.conf
-    regexp: '^protected-mode '
+    regexp: "^protected-mode "
     line: protected-mode no
   when: ansible_distribution_major_version == "9"
   notify:
@@ -20,7 +20,7 @@
 - name: Edit redis config on rhel8
   ansible.builtin.lineinfile:
     path: /etc/redis.conf
-    regexp: '^bind '
+    regexp: "^bind "
     line: bind 0.0.0.0
   when: ansible_distribution_major_version == "8"
   notify:
@@ -47,6 +47,55 @@
     path: "{{ timestamped_deployment_path }}"
     state: directory
 
+- name: Create a folder for secrets
+  ansible.builtin.file:
+    owner: "{{ service_user }}"
+    path: "/etc/bec/secrets"
+    state: directory
+    mode: "0750"
+
+- name: Get BEC Atlas authentication token
+  ansible.builtin.uri:
+    url: "https://bec-atlas-qa.psi.ch/api/v1/user/login"
+    method: POST
+    body_format: json
+    body:
+      username: "admin@bec_atlas.ch"
+      password: "{{ bec_atlas_token }}"
+    return_content: yes
+    status_code: 200
+  register: atlas_auth_response
+  when: bec_atlas_token is defined
+  ignore_errors: true
+  no_log: true
+
+- name: Fetch deployment credentials from BEC Atlas
+  ansible.builtin.uri:
+    url: "https://bec-atlas-qa.psi.ch/api/v1/deploymentCredentials/env"
+    method: GET
+    headers:
+      Authorization: "Bearer {{ atlas_auth_response.content | trim | regex_replace('^\"(.*)\"$', '\\1') }}"
+    body_format: form-urlencoded
+    body:
+      deployment_name: "{{ ansible_fqdn }}"
+    return_content: yes
+    status_code: 200
+  register: atlas_credentials
+  when:
+    - bec_atlas_token is defined
+    - atlas_auth_response is succeeded
+  ignore_errors: true
+  no_log: true
+
+- name: Save BEC Atlas credentials to file
+  ansible.builtin.copy:
+    content: "{{ atlas_credentials.content }}"
+    dest: "/etc/bec/secrets/.atlas.env"
+    mode: "0600"
+  become_user: "{{ service_user }}"
+  when: bec_atlas_token is defined and atlas_credentials is succeeded
+  ignore_errors: true
+
 - name: Clone BEC repository
   become_user: "{{ deployment_user }}"
   ansible.builtin.git:
diff --git a/templates/bec_config_server.yaml.j2 b/templates/bec_config_server.yaml.j2
index 33c81e9..336f38b 100644
--- a/templates/bec_config_server.yaml.j2
+++ b/templates/bec_config_server.yaml.j2
@@ -6,6 +6,8 @@ file_writer:
 log_writer:
   base_path: {{ log_writer_base_path }}
 scilog:
-  env_file: ./
+  env_file: /etc/bec/secrets/.scilog.env
 acl:
-  acl_file: ./.bec_acl.env
+  env_file: /etc/bec/secrets/.bec_acl.env
+atlas:
+  env_file: /etc/bec/secrets/.atlas.env
diff --git a/vars/main.yaml b/vars/main.yaml
index 9aa320f..e60fc52 100644
--- a/vars/main.yaml
+++ b/vars/main.yaml
@@ -3,3 +3,4 @@ deployment_path: "{{ deployment_path_prefix }}/{{ deployment_name }}_deployments
 timestamped_deployment_path: "{{ deployment_path }}/{{ ansible_date_time['iso8601_basic_short'] }}"
 bec_venv_path: "{{ timestamped_deployment_path }}/bec_venv"
 user_git_branch_name: "{{ git_username }}_{{ deployment_name }}_{{ ansible_date_time['iso8601_basic_short'] }}"
+bec_atlas_token: "{{ lookup('env', 'BEC_ATLAS_TOKEN') }}"