diff --git a/ansible/roles/schulcloud-server-core/templates/tldraw-server-onepassword.yml.j2 b/ansible/roles/schulcloud-server-core/templates/tldraw-server-onepassword.yml.j2
new file mode 100644
index 00000000000..14021d8bd9c
--- /dev/null
+++ b/ansible/roles/schulcloud-server-core/templates/tldraw-server-onepassword.yml.j2
@@ -0,0 +1,9 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: tldraw-server-secret
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: tldraw-server
+spec:
+  itemPath: "vaults/{{ ONEPASSWORD_OPERATOR_VAULT }}/items/tldraw-server"