diff --git a/lib/k8s.nix b/lib/k8s.nix
index 475ead2..97b3266 100644
--- a/lib/k8s.nix
+++ b/lib/k8s.nix
@@ -3,9 +3,9 @@
 with lib;
 
 rec {
-  mkSecretOption = {description ? "", default ? {}}: mkOption ({
+  mkSecretOption = {description ? "", default ? {}, allowNull ? true}: mkOption {
     inherit description;
-    type = types.nullOr (types.submodule {
+    type = (if allowNull then types.nullOr else id) (types.submodule {
       options = {
         name = mkOption {
           description = "Name of the secret where secret is stored";