diff --git a/org.jdrupes.vmoperator.common/src/org/jdrupes/vmoperator/common/K8sV1SecretStub.java b/org.jdrupes.vmoperator.common/src/org/jdrupes/vmoperator/common/K8sV1SecretStub.java
index d2fcaf3..18973e0 100644
--- a/org.jdrupes.vmoperator.common/src/org/jdrupes/vmoperator/common/K8sV1SecretStub.java
+++ b/org.jdrupes.vmoperator.common/src/org/jdrupes/vmoperator/common/K8sV1SecretStub.java
@@ -19,9 +19,13 @@
 package org.jdrupes.vmoperator.common;
 
 import io.kubernetes.client.Discovery.APIResource;
+import io.kubernetes.client.openapi.ApiException;
 import io.kubernetes.client.openapi.models.V1Secret;
 import io.kubernetes.client.openapi.models.V1SecretList;
+import io.kubernetes.client.util.generic.options.ListOptions;
+import java.util.Collection;
 import java.util.List;
+import org.jdrupes.vmoperator.common.K8sGenericStub.GenericSupplier;
 
 /**
  * A stub for secrets (v1).
@@ -57,4 +61,31 @@ public class K8sV1SecretStub extends K8sGenericStub<V1Secret, V1SecretList> {
             String name) {
         return new K8sV1SecretStub(client, namespace, name);
     }
+
+    /**
+     * Get the stubs for the objects in the given namespace that match
+     * the criteria from the given options.
+     *
+     * @param client the client
+     * @param namespace the namespace
+     * @param options the options
+     * @return the collection
+     * @throws ApiException the api exception
+     */
+    public static Collection<K8sV1SecretStub> list(K8sClient client,
+            String namespace, ListOptions options) throws ApiException {
+        return K8sGenericStub.list(V1Secret.class, V1SecretList.class, client,
+            CONTEXT, namespace, options, K8sV1SecretStub::getGeneric);
+    }
+
+    /**
+     * Provide {@link GenericSupplier}.
+     */
+    @SuppressWarnings("PMD.UnusedFormalParameter")
+    private static K8sV1SecretStub getGeneric(Class<V1Secret> objectClass,
+            Class<V1SecretList> objectListClass, K8sClient client,
+            APIResource context, String namespace, String name) {
+        return new K8sV1SecretStub(client, namespace, name);
+    }
+
 }
\ No newline at end of file
diff --git a/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Controller.java b/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Controller.java
index 4b8e5aa..cf47f9c 100644
--- a/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Controller.java
+++ b/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Controller.java
@@ -198,7 +198,7 @@ public class Controller extends Component {
             client.defaultPatchOptions());
         if (!res.isPresent()) {
             logger.warning(
-                () -> "Cannot patch pod annotations for " + vmStub.name());
+                () -> "Cannot patch definition for Vm " + vmStub.name());
         }
     }
 }
diff --git a/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Reconciler.java b/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Reconciler.java
index 07944cf..e0fdca0 100644
--- a/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Reconciler.java
+++ b/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/Reconciler.java
@@ -34,6 +34,7 @@ import freemarker.template.TemplateNotFoundException;
 import io.kubernetes.client.custom.Quantity;
 import io.kubernetes.client.openapi.ApiException;
 import io.kubernetes.client.util.generic.dynamic.DynamicKubernetesObject;
+import io.kubernetes.client.util.generic.options.ListOptions;
 import java.io.IOException;
 import java.math.BigDecimal;
 import java.math.BigInteger;
@@ -43,9 +44,13 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import static org.jdrupes.vmoperator.common.Constants.APP_NAME;
 import org.jdrupes.vmoperator.common.Convertions;
+import org.jdrupes.vmoperator.common.K8sClient;
 import org.jdrupes.vmoperator.common.K8sDynamicModel;
 import org.jdrupes.vmoperator.common.K8sObserver;
+import org.jdrupes.vmoperator.common.K8sV1SecretStub;
+import static org.jdrupes.vmoperator.manager.Constants.COMP_DISPLAY_SECRET;
 import org.jdrupes.vmoperator.manager.events.VmChannel;
 import org.jdrupes.vmoperator.manager.events.VmDefChanged;
 import org.jdrupes.vmoperator.util.ExtendedObjectWrapper;
@@ -200,7 +205,8 @@ public class Reconciler extends Component {
         }
 
         // Reconcile, use "augmented" vm definition for model
-        Map<String, Object> model = prepareModel(patchCr(event.vmDefinition()));
+        Map<String, Object> model
+            = prepareModel(channel.client(), patchCr(event.vmDefinition()));
         var configMap = cmReconciler.reconcile(event, model, channel);
         model.put("cm", configMap.getRaw());
         stsReconciler.reconcile(event, model, channel);
@@ -263,8 +269,9 @@ public class Reconciler extends Component {
     }
 
     @SuppressWarnings("PMD.CognitiveComplexity")
-    private Map<String, Object> prepareModel(DynamicKubernetesObject vmDef)
-            throws TemplateModelException {
+    private Map<String, Object> prepareModel(K8sClient client,
+            DynamicKubernetesObject vmDef)
+            throws TemplateModelException, ApiException {
         @SuppressWarnings("PMD.UseConcurrentHashMap")
         Map<String, Object> model = new HashMap<>();
         model.put("managerVersion",
@@ -278,6 +285,20 @@ public class Reconciler extends Component {
                     .get(Constants.class.getName()));
         model.put("reconciler", config);
 
+        // Check if we have a display secret
+        ListOptions options = new ListOptions();
+        options.setLabelSelector("app.kubernetes.io/name=" + APP_NAME + ","
+            + "app.kubernetes.io/component=" + COMP_DISPLAY_SECRET + ","
+            + "app.kubernetes.io/instance=" + vmDef.getMetadata().getName());
+        var dsStub = K8sV1SecretStub
+            .list(client, vmDef.getMetadata().getNamespace(), options).stream()
+            .findFirst();
+        if (dsStub.isPresent()) {
+            dsStub.get().model().ifPresent(m -> {
+                model.put("displaySecret", m.getMetadata().getName());
+            });
+        }
+
         // Methods
         model.put("parseQuantity", new TemplateMethodModelEx() {
             @Override
diff --git a/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/StatefulSetReconciler.java b/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/StatefulSetReconciler.java
index e642502..8812a93 100644
--- a/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/StatefulSetReconciler.java
+++ b/org.jdrupes.vmoperator.manager/src/org/jdrupes/vmoperator/manager/StatefulSetReconciler.java
@@ -28,7 +28,6 @@ import java.io.IOException;
 import java.io.StringWriter;
 import java.util.Map;
 import java.util.logging.Logger;
-import org.jdrupes.vmoperator.common.K8sV1SecretStub;
 import org.jdrupes.vmoperator.common.K8sV1StatefulSetStub;
 import org.jdrupes.vmoperator.manager.events.VmChannel;
 import org.jdrupes.vmoperator.manager.events.VmDefChanged;
@@ -70,13 +69,6 @@ import org.yaml.snakeyaml.constructor.SafeConstructor;
             throws IOException, TemplateException, ApiException {
         var metadata = event.vmDefinition().getMetadata();
 
-        // Check if we have a display secret
-        var dsStub = K8sV1SecretStub.get(channel.client(),
-            metadata.getNamespace(), metadata.getName() + "-display-secret");
-        dsStub.model().ifPresent(m -> {
-            model.put("displaySecret", m.getMetadata().getName());
-        });
-
         // Combine template and data and parse result
         var fmTemplate = fmConfig.getTemplate("runnerSts.ftl.yaml");
         StringWriter out = new StringWriter();