diff --git a/lib.nix b/lib.nix
index 2ac6747..18e57d6 100644
--- a/lib.nix
+++ b/lib.nix
@@ -57,16 +57,16 @@ rec {
           type = types.str;
         };
       };
-
-      config = mkIf (hasAttr "default" options) (mkAllDefault options.default 1000);
+    } // optionalAttrs (hasAttr "default" options && options.default != null) {
+      config = mkAllDefault options.default 1000;
     });
 
-    apply = value: {
+    apply = value: if value == null then null else {
       valueFrom.secretKeyRef = {
         inherit (value) name key;
       };
     };
 
-    default = {};
+    default = null;
   });
 }
diff --git a/test/modules.nix b/test/modules.nix
index 204a918..2477ac3 100644
--- a/test/modules.nix
+++ b/test/modules.nix
@@ -15,10 +15,7 @@ with lib;
 
         password = mkSecretOption {
           description = "Nginx simple auth credentials";
-          default = {
-            name = "test";
-            key = "password";
-          };
+          default = null;
         };
       };
 
@@ -32,7 +29,7 @@ with lib;
               containerPort = config.port;
             };
 
-            spec.template.spec.containers.nginx.env.name = config.password;
+            spec.template.spec.containers.nginx.env.name = mkIf (config.password != null) config.password;
           }
         ];
 
@@ -53,6 +50,7 @@ with lib;
     kubernetes.modules.app-v1 = {
       module = "nginx";
       configuration.password.name = "test2";
+      configuration.password.key = "password";
     };
     kubernetes.modules.app-v2 = {
       module = "nginx";