diff --git a/internal/app/app.go b/internal/app/app.go
index 6cf9ab4..13a95c2 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -141,9 +141,10 @@
 	if err != nil || !loadedConfigs {
 		log.Warnf("no valid snapshot found, creating empty snapshot")
 		snap, _ = cachev3.NewSnapshot("snap-init", map[resourcev3.Type][]types.Resource{
-			resourcev3.ClusterType:  {},
-			resourcev3.RouteType:    {},
-			resourcev3.ListenerType: {},
+			resourcev3.ClusterType:         {},
+			resourcev3.RouteType:           {},
+			resourcev3.ListenerType:        {},
+			resourcev3.ExtensionConfigType: {},
 			// Add other resource types if needed (e.g., resourcev3.SecretType)
 		})
 		if err := manager.Cache.SetSnapshot(ctx, cfg.NodeID, snap); err != nil {
diff --git a/internal/pkg/snapshot/resource_io.go b/internal/pkg/snapshot/resource_io.go
index 399a051..1307847 100644
--- a/internal/pkg/snapshot/resource_io.go
+++ b/internal/pkg/snapshot/resource_io.go
@@ -182,6 +182,11 @@
 		out[resourcev3.SecretType] = append(out[resourcev3.SecretType], r)
 	}
 
+	extensionConfigTypeResources := snap.GetResources(resourcev3.ExtensionConfigType)
+	for _, r := range extensionConfigTypeResources {
+		out[resourcev3.ExtensionConfigType] = append(out[resourcev3.ExtensionConfigType], r)
+	}
+
 	data, err := json.MarshalIndent(out, "", "  ")
 	if err != nil {
 		return err
diff --git a/internal/pkg/storage/postgres.go b/internal/pkg/storage/postgres.go
index bf89312..5f68329 100644
--- a/internal/pkg/storage/postgres.go
+++ b/internal/pkg/storage/postgres.go
@@ -93,10 +93,10 @@
 func (p *PostgresStrategy) SaveSecretSQL(ph []string) string {
 	// ph[0] = name, ph[1] = data, ph[2] = domain
 	return fmt.Sprintf(`
-		INSERT INTO secrets (name, data, enabled, updated_at, domain)
-		VALUES (%s, %s, true, now(), %s)
-		ON CONFLICT (name) DO UPDATE SET data = %s, enabled = true, updated_at = now(), domain = %s`,
-		ph[0], ph[1], ph[2], ph[1], ph[2]) // Note: $2, $3 are repeated for the update clause
+		INSERT INTO secrets (name, data, enabled, updated_at)
+		VALUES (%s, %s, true, now())
+		ON CONFLICT (name) DO UPDATE SET data = %s, enabled = true, updated_at = now()`,
+		ph[0], ph[1], ph[1]) // Note: $2, $3 are repeated for the update clause
 }
 
 func (p *PostgresStrategy) SaveClusterSQL(ph []string) string {
diff --git a/internal/pkg/storage/sqlite.go b/internal/pkg/storage/sqlite.go
index 795722a..07bb6aa 100644
--- a/internal/pkg/storage/sqlite.go
+++ b/internal/pkg/storage/sqlite.go
@@ -142,13 +142,6 @@
 }
 
 func (s *SQLiteStrategy) RestoreRawRowSQL(table string) string {
-	if table == "secrets" {
-		return `
-			INSERT INTO secrets (name, data, enabled, updated_at, domain)
-			VALUES (?, ?, 1, CURRENT_TIMESTAMP, ?)
-			ON CONFLICT(name)
-			DO UPDATE SET data=excluded.data, enabled=1, updated_at=CURRENT_TIMESTAMP, domain=excluded.domain`
-	}
 	// clusters or listeners
 	return fmt.Sprintf(`
 		INSERT INTO %s (name, data, enabled, updated_at)
diff --git a/internal/pkg/storage/storage_dump.go b/internal/pkg/storage/storage_dump.go
index 2c443cf..10b359b 100644
--- a/internal/pkg/storage/storage_dump.go
+++ b/internal/pkg/storage/storage_dump.go
@@ -143,9 +143,7 @@
 
 			// Handle arguments based on table (secrets needs 3 args, others need 2)
 			// MODIFIED: Added "extension_configs" which uses the 2-argument format
-			if table == "secrets" {
-				args = []interface{}{r.Name, string(r.Data)}
-			} else if table == "clusters" || table == "listeners" || table == "extension_configs" {
+			if table == "clusters" || table == "listeners" || table == "secrets" || table == "extension_configs" {
 				args = []interface{}{r.Name, string(r.Data)}
 			} else {
 				return fmt.Errorf("unsupported table for saveRaw: %s", table)