diff --git a/k8s-ng/core/postgresql/databases/meguri.yaml b/k8s-ng/core/postgresql/databases/meguri.yaml
new file mode 100644
index 0000000..42cc36f
--- /dev/null
+++ b/k8s-ng/core/postgresql/databases/meguri.yaml
@@ -0,0 +1,81 @@
+# Database "meguri": password, role, database and read access for the app.
+# To add another database copy this file and replace the name.
+
+# Generated once; the role and the application both read this Secret.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: meguri-db
+  namespace: psql
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: meguri-db
+    template:
+      type: kubernetes.io/basic-auth
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        username: meguri
+        password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: db-password
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: main-meguri
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: meguri
+  login: true
+  passwordSecret:
+    name: meguri-db
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: main-meguri
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: meguri
+  owner: meguri
+  databaseReclaimPolicy: retain
+---
+# Lets the meguri namespace read only its own credentials Secret.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: meguri-db-reader
+  namespace: psql
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    resourceNames: [meguri-db]
+    verbs: [get, list, watch]
+  - apiGroups: [authorization.k8s.io]
+    resources: [selfsubjectrulesreviews]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: meguri-db-reader
+  namespace: psql
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: meguri-db-reader
+subjects:
+  - kind: ServiceAccount
+    name: db-credentials-reader
+    namespace: meguri
diff --git a/k8s-ng/core/postgresql/kustomization.yaml b/k8s-ng/core/postgresql/kustomization.yaml
index d123d76..ba81bee 100644
--- a/k8s-ng/core/postgresql/kustomization.yaml
+++ b/k8s-ng/core/postgresql/kustomization.yaml
@@ -8,3 +8,4 @@ resources:
   - databases/keycloak.yaml
   - databases/furumi.yaml
   - databases/web-petting.yaml
+  - databases/meguri.yaml