diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 0e44978..6b377db 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Release version (e.g. v1.0.3)"
+        description: "Release version (e.g. v1.0.4)"
         required: true
       channel:
         description: "Release channel"
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index dcafaaf..42b65cf 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Release version (e.g. v1.0.3)"
+        description: "Release version (e.g. v1.0.4)"
         required: true
       message:
         description: "Tag message"
diff --git a/README.md b/README.md
index af60488..c3f706a 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ To install `provider-http`, you have two options:
 1. Using the Crossplane CLI in a Kubernetes cluster where Crossplane is installed:
 
    ```console
-   crossplane xpkg install provider xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.3
+   crossplane xpkg install provider xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.4
    ```
 
 2. Manually creating a Provider by applying the following YAML:
@@ -20,7 +20,7 @@ To install `provider-http`, you have two options:
    metadata:
      name: provider-http
    spec:
-     package: "xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.3"
+     package: "xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.4"
    ```
 
 ## Supported Resources
diff --git a/apis/disposablerequest/v1alpha2/disposablerequest_types.go b/apis/disposablerequest/v1alpha2/disposablerequest_types.go
index 339016f..ab6c5eb 100644
--- a/apis/disposablerequest/v1alpha2/disposablerequest_types.go
+++ b/apis/disposablerequest/v1alpha2/disposablerequest_types.go
@@ -76,6 +76,9 @@ type SecretInjectionConfig struct {
 
 	// ResponsePath is is a jq filter expression represents the path in the response where the secret value will be extracted from.
 	ResponsePath string `json:"responsePath"`
+
+	// SetOwnerReference determines whether to set the owner reference on the Kubernetes secret.
+	SetOwnerReference bool `json:"setOwnerReference,omitempty"`
 }
 
 // SecretRef contains the name and namespace of a Kubernetes secret.
diff --git a/apis/request/v1alpha2/request_types.go b/apis/request/v1alpha2/request_types.go
index 7bd4900..b685c0f 100644
--- a/apis/request/v1alpha2/request_types.go
+++ b/apis/request/v1alpha2/request_types.go
@@ -75,6 +75,9 @@ type SecretInjectionConfig struct {
 
 	// ResponsePath is is a jq filter expression represents the path in the response where the secret value will be extracted from.
 	ResponsePath string `json:"responsePath"`
+
+	// SetOwnerReference determines whether to set the owner reference on the Kubernetes secret.
+	SetOwnerReference bool `json:"setOwnerReference,omitempty"`
 }
 
 // SecretRef contains the name and namespace of a Kubernetes secret.
diff --git a/cluster/test/setup.sh b/cluster/test/setup.sh
index 97e6188..f71fd87 100755
--- a/cluster/test/setup.sh
+++ b/cluster/test/setup.sh
@@ -20,39 +20,39 @@ cat <<EOF | ${KUBECTL} apply -f -
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: todo
+  name: flask-api
+  namespace: default
   labels:
-    app: todo
+    app: flask-api
 spec:
-  replicas: 1 
+  replicas: 3
   selector:
     matchLabels:
-      app: todo
+      app: flask-api
   template:
     metadata:
       labels:
-        app: todo
+        app: flask-api
     spec:
       containers:
-      - name: todo
-        image: danielsinai/todo:v1.0.0
-        env:
-        - name: PORT
-          value: "80"
+      - name: flask-api
+        image: arielsepton/flask-api:latest
         ports:
-        - containerPort: 80
+        - containerPort: 5000
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: todo
+  name: flask-api
+  namespace: default
 spec:
-  type: ClusterIP
+  selector:
+    app: flask-api
   ports:
-  - name: "todo"
+  - protocol: TCP
     port: 80
-  selector:
-    app: todo
+    targetPort: 5000
+  type: ClusterIP
 EOF
 
 cat <<EOF | kubectl apply -f -
@@ -70,9 +70,20 @@ cat <<EOF | kubectl apply -f -
 kind: Secret
 apiVersion: v1
 metadata:
-  name: password
+  name: user-password
+  namespace: crossplane-system
+type: Opaque
+data:
+  password: bXktc2VjcmV0LXZhbHVl
+EOF
+
+cat <<EOF | kubectl apply -f -
+kind: Secret
+apiVersion: v1
+metadata:
+  name: basic-auth
   namespace: crossplane-system
 type: Opaque
 data:
-  secretKey: bXktc2VjcmV0LXZhbHVl
+  token: bXktc2VjcmV0LXZhbHVl
 EOF
diff --git a/deploy.yml b/deploy.yml
index e93453a..9f8b725 100644
--- a/deploy.yml
+++ b/deploy.yml
@@ -4,7 +4,7 @@ kind: Provider
 metadata:
   name: http-provider
 spec:
-  package: xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.3
+  package: xpkg.upbound.io/crossplane-contrib/provider-http:v1.0.4
   controllerConfigRef:
     name: debug-config
 
diff --git a/examples/sample/disposablerequest.yaml b/examples/sample/disposablerequest.yaml
index c1803e1..9d59845 100644
--- a/examples/sample/disposablerequest.yaml
+++ b/examples/sample/disposablerequest.yaml
@@ -1,28 +1,28 @@
 apiVersion: http.crossplane.io/v1alpha2
 kind: DisposableRequest
 metadata:
-  name: health-check
+  name: send-notification
 spec:
   deletionPolicy: Orphan
   forProvider:
     # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
-    url:  http://todo.default.svc.cluster.local/health-check
+    url:  http://flask-api.default.svc.cluster.local/v1/notify
     method: POST
     body: |
       {
-        "check_type": "simple",
-        "additional_info": "optional",
-        "password": "secretdata {{ password:crossplane-system:secretKey }}"
+        "recipient": "user@example.com",
+        "subject": "Alert",
+        "message": "Your action is required immediately."
       }
     headers:
-      User-Agent:
-        - "Crossplane Health Checker"
+      Content-Type:
+        - application/json
       Authorization:
         - "Bearer {{ auth:default:token }}"
     insecureSkipTLSVerify: true
 
     # The 'expectedResponse' field is optional. If used, also set 'rollbackRetriesLimit', which determines the number of HTTP requests to be sent until the jq query returns true.
-    # expectedResponse: '.body.job_status == "success"'
+    expectedResponse: '.body.status == "sent"'
     rollbackRetriesLimit: 5
     waitTimeout: 5m
 
@@ -35,15 +35,19 @@ spec:
     # Secrets receiving patches from response data
     secretInjectionConfigs: 
       - secretRef:
-          name: response-secret
+          name: notification-response
           namespace: default
-        secretKey: extracted-data
-        responsePath: .body.reminder
+        secretKey: notification-status
+        responsePath: .body.status
+        # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
+        # When injecting multiple keys into the same secret, ensure this field is set consistently for all keys.        
+        setOwnerReference: true
       - secretRef:
-          name: response-secret
+          name: notification-response
           namespace: default
-        secretKey: extracted-data-headers
-        responsePath: .headers.Try[0]
+        secretKey: notification-id
+        responsePath: .body.id
+        setOwnerReference: true
   providerConfigRef:
     name: http-conf
 # TODO: check if it's possible to modify the deletionPolicy to be orphan by default.
diff --git a/examples/sample/disposablerequest_jwt.yaml b/examples/sample/disposablerequest_jwt.yaml
new file mode 100644
index 0000000..106a2d6
--- /dev/null
+++ b/examples/sample/disposablerequest_jwt.yaml
@@ -0,0 +1,40 @@
+apiVersion: http.crossplane.io/v1alpha2
+kind: DisposableRequest
+metadata:
+  name: obtain-jwt-token
+spec:
+  deletionPolicy: Orphan
+  forProvider:
+    insecureSkipTLSVerify: true
+
+    # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
+    headers:
+      Authorization:
+        - "Basic {{ basic-auth:crossplane-system:token }}"
+    url:  http://flask-api.default.svc.cluster.local/v1/login
+    method: POST
+    
+    shouldLoopInfinitely: true
+    nextReconcile: 72h # 3 days
+
+    # waitTimeout: 5m
+
+    # Indicates whether the reconciliation should loop indefinitely. If `rollbackRetriesLimit` is set and the request returns an error, it will stop reconciliation once the limit is reached.
+    # shouldLoopInfinitely: true
+
+    # Specifies the duration after which the next reconcile should occur.
+    # nextReconcile: 3m 
+
+    # Secrets receiving patches from response data
+    secretInjectionConfigs: 
+      - secretRef:
+          name: obtained-token
+          namespace: crossplane-system
+        secretKey: token
+        responsePath: .body.token
+        # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
+        # When injecting multiple keys into the same secret, ensure this field is set consistently for all keys.        
+        setOwnerReference: true
+  providerConfigRef:
+    name: http-conf
+# TODO: check if it's possible to modify the deletionPolicy to be orphan by default.
diff --git a/examples/sample/request.yaml b/examples/sample/request.yaml
index f0e49b8..f012736 100644
--- a/examples/sample/request.yaml
+++ b/examples/sample/request.yaml
@@ -1,7 +1,7 @@
 apiVersion: http.crossplane.io/v1alpha2
 kind: Request
 metadata:
-  name: laundry
+  name: manage-user
 spec:
   forProvider:
     # Injecting data from secrets is possible, simply use the following syntax: {{ name:namespace:key }} (supported for body and headers only)
@@ -13,21 +13,22 @@ spec:
       Authorization:
         - ("Bearer {{ auth:default:token }}")
     payload:
-      baseUrl: http://todo.default.svc.cluster.local/todos
+      baseUrl: http://flask-api.default.svc.cluster.local/v1/users
       body: |
         {
-          "name": "Do Laundry", 
-          "reminder": "Every 1 hour", 
-          "responsible": "Dan",
-          "password": "secretdata {{ password:crossplane-system:secretKey }}"
+          "username": "mock_user", 
+          "password": "secretdata {{ user-password:crossplane-system:password }}",
+          "email": "mock_user@example.com", 
+          "age": 30
         }
     mappings:
       - method: "POST"
         body: |
           {
-            todo_name: .payload.body.name, 
-            reminder: .payload.body.reminder, 
-            responsible: .payload.body.responsible,
+            username: .payload.body.username, 
+            email: .payload.body.email, 
+            age: .payload.body.age,
+            password: .payload.body.password
           }
         url: .payload.baseUrl
         headers:
@@ -42,9 +43,8 @@ spec:
       - method: "PUT"
         body: |
           {
-            todo_name: .payload.body.name, 
-            reminder: .payload.body.reminder, 
-            responsible: .payload.body.responsible
+            email: .payload.body.email, 
+            age: .payload.body.age
           }
         url: (.payload.baseUrl + "/" + (.response.body.id|tostring))
       - method: "DELETE"
@@ -55,12 +55,21 @@ spec:
       - secretRef:
           name: response-secret
           namespace: default
-        secretKey: extracted-data
-        responsePath: .body.reminder
+        secretKey: extracted-user-email
+        responsePath: .body.email
+        # setOwnerReference determines if the secret should be deleted when the associated resource is deleted.
+        # When injecting multiple keys into the same secret, ensure this field is set consistently for all keys.        
+        setOwnerReference: true
       - secretRef:
           name: response-secret
           namespace: default
-        secretKey: extracted-data-headers
-        responsePath: .headers.Try[0]
+        secretKey: extracted-header-data
+        responsePath: .headers."X-Secret-Header"[0]
+        setOwnerReference: true
+      - secretRef:
+          name: response-user-password
+          namespace: default
+        secretKey: extracted-user-password
+        responsePath: .body.password
   providerConfigRef:
     name: http-conf
diff --git a/internal/controller/disposablerequest/disposablerequest.go b/internal/controller/disposablerequest/disposablerequest.go
index c3f92ce..4a27a07 100644
--- a/internal/controller/disposablerequest/disposablerequest.go
+++ b/internal/controller/disposablerequest/disposablerequest.go
@@ -42,6 +42,7 @@ import (
 	apisv1alpha1 "github.com/crossplane-contrib/provider-http/apis/v1alpha1"
 	httpClient "github.com/crossplane-contrib/provider-http/internal/clients/http"
 	"github.com/crossplane-contrib/provider-http/internal/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 const (
@@ -171,12 +172,12 @@ func (c *external) Observe(ctx context.Context, mg resource.Managed) (managed.Ex
 }
 
 func (c *external) deployAction(ctx context.Context, cr *v1alpha2.DisposableRequest) error {
-	sensitiveBody, err := datapatcher.PatchSecretsIntoBody(ctx, c.localKube, cr.Spec.ForProvider.Body)
+	sensitiveBody, err := datapatcher.PatchSecretsIntoBody(ctx, c.localKube, cr.Spec.ForProvider.Body, c.logger)
 	if err != nil {
 		return err
 	}
 
-	sensitiveHeaders, err := datapatcher.PatchSecretsIntoHeaders(ctx, c.localKube, cr.Spec.ForProvider.Headers)
+	sensitiveHeaders, err := datapatcher.PatchSecretsIntoHeaders(ctx, c.localKube, cr.Spec.ForProvider.Headers, c.logger)
 	if err != nil {
 		return err
 	}
@@ -288,7 +289,13 @@ func (c *external) Delete(_ context.Context, _ resource.Managed) error {
 
 func (c *external) patchResponseToSecret(ctx context.Context, cr *v1alpha2.DisposableRequest, response *httpClient.HttpResponse) {
 	for _, ref := range cr.Spec.ForProvider.SecretInjectionConfigs {
-		err := datapatcher.PatchResponseToSecret(ctx, c.localKube, c.logger, response, ref.ResponsePath, ref.SecretKey, ref.SecretRef.Name, ref.SecretRef.Namespace)
+		var owner metav1.Object = nil
+
+		if ref.SetOwnerReference {
+			owner = cr
+		}
+
+		err := datapatcher.PatchResponseToSecret(ctx, c.localKube, c.logger, response, ref.ResponsePath, ref.SecretKey, ref.SecretRef.Name, ref.SecretRef.Namespace, owner)
 		if err != nil {
 			c.logger.Info(fmt.Sprintf(errPatchDataToSecret, ref.SecretRef.Name, ref.SecretRef.Namespace, ref.SecretKey, err.Error()))
 		}
diff --git a/internal/controller/request/observe.go b/internal/controller/request/observe.go
index e478683..b2d41b6 100644
--- a/internal/controller/request/observe.go
+++ b/internal/controller/request/observe.go
@@ -116,7 +116,7 @@ func (c *external) requestDetails(ctx context.Context, cr *v1alpha2.Request, met
 		return requestgen.RequestDetails{}, errors.Errorf(errMappingNotFound, method)
 	}
 
-	return generateValidRequestDetails(ctx, c.localKube, cr, mapping)
+	return c.generateValidRequestDetails(ctx, cr, mapping)
 }
 
 // isErrorMappingNotFound checks if the provided error indicates that the
diff --git a/internal/controller/request/request.go b/internal/controller/request/request.go
index 9d38e9c..369a1e0 100644
--- a/internal/controller/request/request.go
+++ b/internal/controller/request/request.go
@@ -42,6 +42,7 @@ import (
 	"github.com/crossplane-contrib/provider-http/internal/controller/request/statushandler"
 	datapatcher "github.com/crossplane-contrib/provider-http/internal/data-patcher"
 	"github.com/crossplane-contrib/provider-http/internal/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 const (
@@ -189,7 +190,7 @@ func (c *external) deployAction(ctx context.Context, cr *v1alpha2.Request, metho
 		return nil
 	}
 
-	requestDetails, err := generateValidRequestDetails(ctx, c.localKube, cr, mapping)
+	requestDetails, err := c.generateValidRequestDetails(ctx, cr, mapping)
 	if err != nil {
 		return err
 	}
@@ -234,7 +235,13 @@ func (c *external) Delete(ctx context.Context, mg resource.Managed) error {
 
 func (c *external) patchResponseToSecret(ctx context.Context, cr *v1alpha2.Request, response *httpClient.HttpResponse) {
 	for _, ref := range cr.Spec.ForProvider.SecretInjectionConfigs {
-		err := datapatcher.PatchResponseToSecret(ctx, c.localKube, c.logger, response, ref.ResponsePath, ref.SecretKey, ref.SecretRef.Name, ref.SecretRef.Namespace)
+		var owner metav1.Object = nil
+
+		if ref.SetOwnerReference {
+			owner = cr
+		}
+
+		err := datapatcher.PatchResponseToSecret(ctx, c.localKube, c.logger, response, ref.ResponsePath, ref.SecretKey, ref.SecretRef.Name, ref.SecretRef.Namespace, owner)
 		if err != nil {
 			c.logger.Info(fmt.Sprintf(errPatchDataToSecret, ref.SecretRef.Name, ref.SecretRef.Namespace, ref.SecretKey, err.Error()))
 		}
@@ -246,13 +253,13 @@ func (c *external) patchResponseToSecret(ctx context.Context, cr *v1alpha2.Reque
 // details are valid, the function returns them. If not, it falls back to using the cached response in the Request's status
 // and attempts to generate request details again. The function returns the generated request details or an error if the
 // generation process fails.
-func generateValidRequestDetails(ctx context.Context, localKube client.Client, cr *v1alpha2.Request, mapping *v1alpha2.Mapping) (requestgen.RequestDetails, error) {
-	requestDetails, _, ok := requestgen.GenerateRequestDetails(ctx, localKube, *mapping, cr.Spec.ForProvider, cr.Status.Response)
+func (c *external) generateValidRequestDetails(ctx context.Context, cr *v1alpha2.Request, mapping *v1alpha2.Mapping) (requestgen.RequestDetails, error) {
+	requestDetails, _, ok := requestgen.GenerateRequestDetails(ctx, c.localKube, *mapping, cr.Spec.ForProvider, cr.Status.Response, c.logger)
 	if requestgen.IsRequestValid(requestDetails) && ok {
 		return requestDetails, nil
 	}
 
-	requestDetails, err, _ := requestgen.GenerateRequestDetails(ctx, localKube, *mapping, cr.Spec.ForProvider, cr.Status.Cache.Response)
+	requestDetails, err, _ := requestgen.GenerateRequestDetails(ctx, c.localKube, *mapping, cr.Spec.ForProvider, cr.Status.Cache.Response, c.logger)
 	if err != nil {
 		return requestgen.RequestDetails{}, err
 	}
diff --git a/internal/controller/request/requestgen/request_generator.go b/internal/controller/request/requestgen/request_generator.go
index 659bf50..9286173 100644
--- a/internal/controller/request/requestgen/request_generator.go
+++ b/internal/controller/request/requestgen/request_generator.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/crossplane/crossplane-runtime/pkg/logging"
 	"github.com/pkg/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -25,7 +26,7 @@ type RequestDetails struct {
 }
 
 // GenerateRequestDetails generates request details.
-func GenerateRequestDetails(ctx context.Context, localKube client.Client, methodMapping v1alpha2.Mapping, forProvider v1alpha2.RequestParameters, response v1alpha2.Response) (RequestDetails, error, bool) {
+func GenerateRequestDetails(ctx context.Context, localKube client.Client, methodMapping v1alpha2.Mapping, forProvider v1alpha2.RequestParameters, response v1alpha2.Response, logger logging.Logger) (RequestDetails, error, bool) {
 	jqObject := generateRequestObject(forProvider, response)
 	url, err := generateURL(methodMapping.URL, jqObject)
 	if err != nil {
@@ -36,12 +37,12 @@ func GenerateRequestDetails(ctx context.Context, localKube client.Client, method
 		return RequestDetails{}, errors.Errorf(utils.ErrInvalidURL, url), false
 	}
 
-	bodyData, err := generateBody(ctx, localKube, methodMapping.Body, jqObject)
+	bodyData, err := generateBody(ctx, localKube, methodMapping.Body, jqObject, logger)
 	if err != nil {
 		return RequestDetails{}, err, false
 	}
 
-	headersData, err := generateHeaders(ctx, localKube, coalesceHeaders(methodMapping.Headers, forProvider.Headers), jqObject)
+	headersData, err := generateHeaders(ctx, localKube, coalesceHeaders(methodMapping.Headers, forProvider.Headers), jqObject, logger)
 	if err != nil {
 		return RequestDetails{}, err, false
 	}
@@ -86,7 +87,7 @@ func generateURL(urlJQFilter string, jqObject map[string]interface{}) (string, e
 }
 
 // generateBody applies a mapping body to generate the request body.
-func generateBody(ctx context.Context, localKube client.Client, mappingBody string, jqObject map[string]interface{}) (httpClient.Data, error) {
+func generateBody(ctx context.Context, localKube client.Client, mappingBody string, jqObject map[string]interface{}, logger logging.Logger) (httpClient.Data, error) {
 	if mappingBody == "" {
 		return httpClient.Data{
 			Encrypted: "",
@@ -100,7 +101,7 @@ func generateBody(ctx context.Context, localKube client.Client, mappingBody stri
 		return httpClient.Data{}, err
 	}
 
-	sensitiveBody, err := datapatcher.PatchSecretsIntoBody(ctx, localKube, body)
+	sensitiveBody, err := datapatcher.PatchSecretsIntoBody(ctx, localKube, body, logger)
 	if err != nil {
 		return httpClient.Data{}, err
 	}
@@ -112,13 +113,13 @@ func generateBody(ctx context.Context, localKube client.Client, mappingBody stri
 }
 
 // generateHeaders applies JQ queries to generate headers.
-func generateHeaders(ctx context.Context, localKube client.Client, headers map[string][]string, jqObject map[string]interface{}) (httpClient.Data, error) {
+func generateHeaders(ctx context.Context, localKube client.Client, headers map[string][]string, jqObject map[string]interface{}, logger logging.Logger) (httpClient.Data, error) {
 	generatedHeaders, err := requestprocessing.ApplyJQOnMapStrings(headers, jqObject)
 	if err != nil {
 		return httpClient.Data{}, err
 	}
 
-	sensitiveHeaders, err := datapatcher.PatchSecretsIntoHeaders(ctx, localKube, generatedHeaders)
+	sensitiveHeaders, err := datapatcher.PatchSecretsIntoHeaders(ctx, localKube, generatedHeaders, logger)
 	if err != nil {
 		return httpClient.Data{}, err
 	}
diff --git a/internal/controller/request/requestgen/request_generator_test.go b/internal/controller/request/requestgen/request_generator_test.go
index cf92e39..3947ae1 100644
--- a/internal/controller/request/requestgen/request_generator_test.go
+++ b/internal/controller/request/requestgen/request_generator_test.go
@@ -189,7 +189,7 @@ func Test_GenerateRequestDetails(t *testing.T) {
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
-			got, gotErr, ok := GenerateRequestDetails(context.Background(), tc.args.localKube, tc.args.methodMapping, tc.args.forProvider, tc.args.response)
+			got, gotErr, ok := GenerateRequestDetails(context.Background(), tc.args.localKube, tc.args.methodMapping, tc.args.forProvider, tc.args.response, tc.args.logger)
 			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
 				t.Fatalf("GenerateRequestDetails(...): -want error, +got error: %s", diff)
 			}
diff --git a/internal/controller/request/statushandler/status.go b/internal/controller/request/statushandler/status.go
index 3c4f017..cc7e5da 100644
--- a/internal/controller/request/statushandler/status.go
+++ b/internal/controller/request/statushandler/status.go
@@ -99,7 +99,7 @@ func (r *requestStatusHandler) appendExtraSetters(forProvider v1alpha2.RequestPa
 func (r *requestStatusHandler) shouldSetCache(forProvider v1alpha2.RequestParameters) bool {
 	for _, mapping := range forProvider.Mappings {
 		response := responseconverter.HttpResponseToV1alpha1Response(r.resource.HttpResponse)
-		requestDetails, _, ok := requestgen.GenerateRequestDetails(r.resource.RequestContext, r.resource.LocalClient, mapping, forProvider, response)
+		requestDetails, _, ok := requestgen.GenerateRequestDetails(r.resource.RequestContext, r.resource.LocalClient, mapping, forProvider, response, r.logger)
 		if !(requestgen.IsRequestValid(requestDetails) && ok) {
 			return false
 		}
diff --git a/internal/data-patcher/parser.go b/internal/data-patcher/parser.go
index 7a3e1c0..e02d216 100644
--- a/internal/data-patcher/parser.go
+++ b/internal/data-patcher/parser.go
@@ -23,6 +23,7 @@ import (
 const (
 	errEmptyKey    = "Warning, value at field %s is empty, skipping secret update for: %s"
 	errConvertData = "failed to convert data to map"
+	errPatchFailed = "failed to patch secret, %s"
 )
 
 const (
@@ -69,7 +70,7 @@ func replacePlaceholderWithSecretValue(originalString, old string, secret *corev
 }
 
 // patchSecretsToValue patches secrets referenced in the provided value.
-func patchSecretsToValue(ctx context.Context, localKube client.Client, valueToHandle string) (string, error) {
+func patchSecretsToValue(ctx context.Context, localKube client.Client, valueToHandle string, logger logging.Logger) (string, error) {
 	placeholders := removeDuplicates(findPlaceholders(valueToHandle))
 	for _, placeholder := range placeholders {
 
@@ -79,6 +80,7 @@ func patchSecretsToValue(ctx context.Context, localKube client.Client, valueToHa
 		}
 		secret, err := kubehandler.GetSecret(ctx, localKube, name, namespace)
 		if err != nil {
+			logger.Info(fmt.Sprintf(errPatchFailed, err.Error()))
 			return "", err
 		}
 
diff --git a/internal/data-patcher/parser_test.go b/internal/data-patcher/parser_test.go
index 9c639a1..14b120c 100644
--- a/internal/data-patcher/parser_test.go
+++ b/internal/data-patcher/parser_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/crossplane/crossplane-runtime/pkg/logging"
 	"github.com/crossplane/crossplane-runtime/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	corev1 "k8s.io/api/core/v1"
@@ -294,7 +295,7 @@ func Test_patchSecretsToValue(t *testing.T) {
 		tc := tc // Create local copies of loop variables
 
 		t.Run(name, func(t *testing.T) {
-			got, err := patchSecretsToValue(context.Background(), tc.args.localKube, tc.args.valueToHandle)
+			got, err := patchSecretsToValue(context.Background(), tc.args.localKube, tc.args.valueToHandle, logging.NewNopLogger())
 			if err != nil {
 				t.Fatalf("patchSecretsToValue(...): unexpected error: %v", err)
 			}
diff --git a/internal/data-patcher/patch.go b/internal/data-patcher/patch.go
index abc319d..4a93a55 100644
--- a/internal/data-patcher/patch.go
+++ b/internal/data-patcher/patch.go
@@ -7,6 +7,7 @@ import (
 	kubehandler "github.com/crossplane-contrib/provider-http/internal/kube-handler"
 	"github.com/crossplane/crossplane-runtime/pkg/logging"
 	"github.com/pkg/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -15,8 +16,8 @@ const (
 )
 
 // PatchSecretsIntoBody patches secrets into the provided string body.
-func PatchSecretsIntoBody(ctx context.Context, localKube client.Client, body string) (string, error) {
-	return patchSecretsToValue(ctx, localKube, body)
+func PatchSecretsIntoBody(ctx context.Context, localKube client.Client, body string, logger logging.Logger) (string, error) {
+	return patchSecretsToValue(ctx, localKube, body, logger)
 }
 
 // PatchSecretsIntoHeaders takes a map of headers and applies security measures to
@@ -24,12 +25,12 @@ func PatchSecretsIntoBody(ctx context.Context, localKube client.Client, body str
 // to avoid modifying the original map and iterates over the copied map
 // to process each list of headers. It then applies the necessary modifications
 // to each header using patchSecretsToValue function.
-func PatchSecretsIntoHeaders(ctx context.Context, localKube client.Client, headers map[string][]string) (map[string][]string, error) {
+func PatchSecretsIntoHeaders(ctx context.Context, localKube client.Client, headers map[string][]string, logger logging.Logger) (map[string][]string, error) {
 	headersCopy := copyHeaders(headers)
 
 	for _, headersList := range headersCopy {
 		for i, header := range headersList {
-			newHeader, err := patchSecretsToValue(ctx, localKube, header)
+			newHeader, err := patchSecretsToValue(ctx, localKube, header, logger)
 			if err != nil {
 				return nil, err
 			}
@@ -51,8 +52,8 @@ func copyHeaders(headers map[string][]string) map[string][]string {
 }
 
 // PatchResponseToSecret patches response data into a Kubernetes secret.
-func PatchResponseToSecret(ctx context.Context, localKube client.Client, logger logging.Logger, data *httpClient.HttpResponse, path, secretKey, secretName, secretNamespace string) error {
-	secret, err := kubehandler.GetOrCreateSecret(ctx, localKube, secretName, secretNamespace)
+func PatchResponseToSecret(ctx context.Context, localKube client.Client, logger logging.Logger, data *httpClient.HttpResponse, path, secretKey, secretName, secretNamespace string, owner metav1.Object) error {
+	secret, err := kubehandler.GetOrCreateSecret(ctx, localKube, secretName, secretNamespace, owner)
 	if err != nil {
 		return err
 	}
diff --git a/internal/data-patcher/patch_test.go b/internal/data-patcher/patch_test.go
index 6324e09..fd18463 100644
--- a/internal/data-patcher/patch_test.go
+++ b/internal/data-patcher/patch_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/crossplane/crossplane-runtime/pkg/logging"
 	"github.com/crossplane/crossplane-runtime/pkg/test"
 	"github.com/google/go-cmp/cmp"
 	"github.com/pkg/errors"
@@ -75,7 +76,7 @@ func TestPatchSecretsIntoBody(t *testing.T) {
 		tc := tc // Create local copies of loop variables
 
 		t.Run(name, func(t *testing.T) {
-			got, gotErr := PatchSecretsIntoBody(tc.args.ctx, tc.args.localKube, tc.args.body)
+			got, gotErr := PatchSecretsIntoBody(tc.args.ctx, tc.args.localKube, tc.args.body, logging.NewNopLogger())
 			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
 				t.Fatalf("isUpToDate(...): -want error, +got error: %s", diff)
 			}
@@ -184,7 +185,7 @@ func TestPatchSecretsIntoHeaders(t *testing.T) {
 		tc := tc // Create local copies of loop variables
 
 		t.Run(name, func(t *testing.T) {
-			got, gotErr := PatchSecretsIntoHeaders(tc.args.ctx, tc.args.localKube, tc.args.headers)
+			got, gotErr := PatchSecretsIntoHeaders(tc.args.ctx, tc.args.localKube, tc.args.headers, logging.NewNopLogger())
 			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
 				t.Fatalf("isUpToDate(...): -want error, +got error: %s", diff)
 			}
diff --git a/internal/kube-handler/client.go b/internal/kube-handler/client.go
index 1aee6a2..b21fe26 100644
--- a/internal/kube-handler/client.go
+++ b/internal/kube-handler/client.go
@@ -2,6 +2,7 @@ package kubehandler
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
@@ -9,12 +10,14 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
 
 const (
-	errCreateSecret = "create secret failed"
-	errGetSecret    = "get secret failed"
-	errUpdateFailed = "update secret failed"
+	errCreateSecret      = "create secret failed"
+	errGetSecret         = "failed to get secret %s:%s"
+	errUpdateFailed      = "update secret failed"
+	errSetOwnerReference = "could not set owner reference to secret"
 )
 
 // GetSecret retrieves a Kubernetes Secret from the cluster.
@@ -26,21 +29,31 @@ func GetSecret(ctx context.Context, kubeClient client.Client, name string, names
 	}, secret)
 
 	if err != nil {
-		return &corev1.Secret{}, errors.Wrap(err, errGetSecret)
+		return nil, errors.Wrap(err, fmt.Sprintf(errGetSecret, name, namespace))
 	}
 
 	return secret, nil
 }
 
 // GetOrCreateSecret retrieves a Kubernetes Secret from the cluster. If the secret does not exist, it creates a new one.
-func GetOrCreateSecret(ctx context.Context, kubeClient client.Client, name string, namespace string) (*corev1.Secret, error) {
+// If the secret exists but has no owner reference, it sets the owner reference and updates the secret.
+func GetOrCreateSecret(ctx context.Context, kubeClient client.Client, name, namespace string, owner metav1.Object) (*corev1.Secret, error) {
 	secret, err := GetSecret(ctx, kubeClient, name, namespace)
 	if err != nil {
 		if errs.IsNotFound(err) {
-			return createSecret(ctx, kubeClient, name, namespace)
+			return createSecret(ctx, kubeClient, name, namespace, owner)
 		}
+		return nil, err
+	}
 
-		return &corev1.Secret{}, err
+	// Check if the owner reference is missing and set it if needed
+	if owner != nil && !hasOwnerReference(secret, owner) {
+		if err := controllerutil.SetOwnerReference(owner, secret, kubeClient.Scheme()); err != nil {
+			return nil, errors.Wrap(err, errSetOwnerReference)
+		}
+		if err := UpdateSecret(ctx, kubeClient, secret); err != nil {
+			return nil, err
+		}
 	}
 
 	return secret, nil
@@ -56,7 +69,8 @@ func UpdateSecret(ctx context.Context, kubeClient client.Client, secret *corev1.
 	return nil
 }
 
-func createSecret(ctx context.Context, kubeClient client.Client, name string, namespace string) (*corev1.Secret, error) {
+// createSecret creates a new Kubernetes Secret in the cluster.
+func createSecret(ctx context.Context, kubeClient client.Client, name, namespace string, owner metav1.Object) (*corev1.Secret, error) {
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: namespace,
@@ -64,10 +78,26 @@ func createSecret(ctx context.Context, kubeClient client.Client, name string, na
 		},
 	}
 
+	if owner != nil {
+		if err := controllerutil.SetOwnerReference(owner, secret, kubeClient.Scheme()); err != nil {
+			return nil, errors.Wrap(err, errSetOwnerReference)
+		}
+	}
+
 	err := kubeClient.Create(ctx, secret)
 	if err != nil {
-		return &corev1.Secret{}, errors.Wrap(err, errCreateSecret)
+		return nil, errors.Wrap(err, errCreateSecret)
 	}
 
 	return secret, nil
 }
+
+// hasOwnerReference checks if the given secret has the specified owner reference.
+func hasOwnerReference(secret *corev1.Secret, owner metav1.Object) bool {
+	for _, ref := range secret.OwnerReferences {
+		if ref.UID == owner.GetUID() {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/kube-handler/client_test.go b/internal/kube-handler/client_test.go
index a20a302..8a8b31f 100644
--- a/internal/kube-handler/client_test.go
+++ b/internal/kube-handler/client_test.go
@@ -3,6 +3,7 @@ package kubehandler
 import (
 	"context"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 
@@ -19,15 +20,20 @@ var (
 )
 
 func createSpecificSecret(name, namespace, key, value string) *corev1.Secret {
-	return &corev1.Secret{
+	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: namespace,
 		},
-		Data: map[string][]byte{
+	}
+
+	if key != "" && value != "" {
+		secret.Data = map[string][]byte{
 			key: []byte(value),
-		},
+		}
 	}
+
+	return secret
 }
 
 func Test_GetSecret(t *testing.T) {
@@ -83,8 +89,8 @@ func Test_GetSecret(t *testing.T) {
 				namespace: "default",
 			},
 			want: want{
-				result: &corev1.Secret{},
-				err:    errorspkg.Wrap(errBoom, errGetSecret),
+				result: nil,
+				err:    errorspkg.Wrap(errBoom, fmt.Sprintf(errGetSecret, "secret", "default")),
 			},
 		},
 	}
@@ -195,8 +201,8 @@ func Test_GetOrCreateSecret(t *testing.T) {
 				namespace: "default",
 			},
 			want: want{
-				result: &corev1.Secret{},
-				err:    errorspkg.Wrap(errBoom, errGetSecret),
+				result: nil,
+				err:    errorspkg.Wrap(errBoom, fmt.Sprintf(errGetSecret, "secret", "default")),
 			},
 		},
 	}
@@ -204,7 +210,7 @@ func Test_GetOrCreateSecret(t *testing.T) {
 		tc := tc // Create local copies of loop variables
 
 		t.Run(name, func(t *testing.T) {
-			got, gotErr := GetOrCreateSecret(context.Background(), tc.args.localKube, tc.args.name, tc.args.namespace)
+			got, gotErr := GetOrCreateSecret(context.Background(), tc.args.localKube, tc.args.name, tc.args.namespace, nil)
 			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
 				t.Fatalf("GetOrCreateSecret(...): -want error, +got error: %s", diff)
 			}
@@ -232,25 +238,10 @@ func Test_UpdateSecret(t *testing.T) {
 			args: args{
 				localKube: &test.MockClient{
 					MockUpdate: func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
-						secret, ok := obj.(*corev1.Secret)
-						if !ok {
-							return errors.New("object is not a Secret")
-						}
-
-						// Simulate updating the secret
-						secret.Data["updated-key"] = []byte("updated-value")
 						return nil
 					},
 				},
-				secret: &corev1.Secret{
-					ObjectMeta: metav1.ObjectMeta{
-						Namespace: "specific-secret-namespace",
-						Name:      "specific-secret-name",
-					},
-					Data: map[string][]byte{
-						"specific-key": []byte("specific-value"),
-					},
-				},
+				secret: createSpecificSecret("update-secret-name", "update-secret-namespace", "update-key", "update-value"),
 			},
 			want: want{
 				err: nil,
@@ -261,18 +252,140 @@ func Test_UpdateSecret(t *testing.T) {
 				localKube: &test.MockClient{
 					MockUpdate: test.NewMockUpdateFn(errBoom),
 				},
+				secret: createSpecificSecret("update-secret-name", "update-secret-namespace", "update-key", "update-value"),
+			},
+			want: want{
+				err: errorspkg.Wrap(errBoom, errUpdateFailed),
+			},
+		},
+	}
+	for name, tc := range cases {
+		tc := tc // Create local copies of loop variables
+
+		t.Run(name, func(t *testing.T) {
+			gotErr := UpdateSecret(context.Background(), tc.args.localKube, tc.args.secret)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("UpdateSecret(...): -want error, +got error: %s", diff)
+			}
+		})
+	}
+}
+
+func Test_createSecret(t *testing.T) {
+	type args struct {
+		localKube client.Client
+		name      string
+		namespace string
+		owner     metav1.Object
+	}
+	type want struct {
+		result *corev1.Secret
+		err    error
+	}
+
+	cases := map[string]struct {
+		args args
+		want want
+	}{
+		"ShouldCreateSecret": {
+			args: args{
+				localKube: &test.MockClient{
+					MockUpdate: test.NewMockUpdateFn(nil),
+					MockCreate: test.NewMockCreateFn(nil),
+					MockGet:    test.NewMockGetFn(nil),
+				},
+				name:      "new-secret-name",
+				namespace: "new-secret-namespace",
+				owner:     nil,
+			},
+			want: want{
+				result: createSpecificSecret("new-secret-name", "new-secret-namespace", "", ""),
+				err:    nil,
+			},
+		},
+		"ShouldFailToCreateSecret": {
+			args: args{
+				localKube: &test.MockClient{
+					MockCreate: test.NewMockCreateFn(errBoom),
+				},
+				name:      "new-secret-name",
+				namespace: "new-secret-namespace",
+				owner:     nil,
+			},
+			want: want{
+				result: nil,
+				err:    errorspkg.Wrap(errBoom, errCreateSecret),
+			},
+		},
+	}
+	for name, tc := range cases {
+		tc := tc // Create local copies of loop variables
+
+		t.Run(name, func(t *testing.T) {
+			got, gotErr := createSecret(context.Background(), tc.args.localKube, tc.args.name, tc.args.namespace, tc.args.owner)
+			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
+				t.Fatalf("createSecret(...): -want error, +got error: %s", diff)
+			}
+			if diff := cmp.Diff(tc.want.result, got); diff != "" {
+				t.Errorf("createSecret(...): -want result, +got result: %s", diff)
+			}
+		})
+	}
+}
+
+func Test_hasOwnerReference(t *testing.T) {
+	type args struct {
+		secret *corev1.Secret
+		owner  metav1.Object
+	}
+	type want struct {
+		result bool
+	}
+
+	cases := map[string]struct {
+		args args
+		want want
+	}{
+		"ShouldHaveOwnerReference": {
+			args: args{
+				secret: &corev1.Secret{
+					ObjectMeta: metav1.ObjectMeta{
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								UID: "owner-uid",
+							},
+						},
+					},
+				},
+				owner: &corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						UID: "owner-uid",
+					},
+				},
+			},
+			want: want{
+				result: true,
+			},
+		},
+		"ShouldNotHaveOwnerReference": {
+			args: args{
 				secret: &corev1.Secret{
 					ObjectMeta: metav1.ObjectMeta{
-						Namespace: "specific-secret-namespace",
-						Name:      "specific-secret-name",
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								UID: "other-owner-uid",
+							},
+						},
 					},
-					Data: map[string][]byte{
-						"specific-key": []byte("specific-value"),
+				},
+				owner: &corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						UID: "owner-uid",
 					},
 				},
 			},
 			want: want{
-				err: errorspkg.Wrap(errBoom, errUpdateFailed),
+				result: false,
 			},
 		},
 	}
@@ -280,9 +393,9 @@ func Test_UpdateSecret(t *testing.T) {
 		tc := tc // Create local copies of loop variables
 
 		t.Run(name, func(t *testing.T) {
-			gotErr := UpdateSecret(context.Background(), tc.args.localKube, tc.args.secret)
-			if diff := cmp.Diff(tc.want.err, gotErr, test.EquateErrors()); diff != "" {
-				t.Fatalf("UpdateSecret(...): -want error, +got error: %s", diff)
+			got := hasOwnerReference(tc.args.secret, tc.args.owner)
+			if diff := cmp.Diff(tc.want.result, got); diff != "" {
+				t.Errorf("hasOwnerReference(...): -want result, +got result: %s", diff)
 			}
 		})
 	}
@@ -307,10 +420,10 @@ func Test_GetOrCreateSecret_EmptyName(t *testing.T) {
 		MockGet: test.NewMockGetFn(errBoom),
 	}
 	// Pass an empty secret name
-	_, err := GetOrCreateSecret(context.Background(), kubeClient, "", "some-namespace")
+	_, err := GetOrCreateSecret(context.Background(), kubeClient, "", "some-namespace", nil)
 
 	// Verify that an error is returned for an empty secret name
-	if err == nil || !strings.Contains(err.Error(), errGetSecret) {
+	if err == nil || !strings.Contains(err.Error(), fmt.Sprintf(errGetSecret, "", "some-namespace")) {
 		t.Errorf("GetOrCreateSecret() with empty name: expected error, got: %v", err)
 	}
 }
diff --git a/package/crds/http.crossplane.io_disposablerequests.yaml b/package/crds/http.crossplane.io_disposablerequests.yaml
index a85a59c..8ac26a5 100644
--- a/package/crds/http.crossplane.io_disposablerequests.yaml
+++ b/package/crds/http.crossplane.io_disposablerequests.yaml
@@ -514,6 +514,10 @@ spec:
                           - name
                           - namespace
                           type: object
+                        setOwnerReference:
+                          description: SetOwnerReference determines whether to set
+                            the owner reference on the Kubernetes secret.
+                          type: boolean
                       required:
                       - responsePath
                       - secretKey
diff --git a/package/crds/http.crossplane.io_requests.yaml b/package/crds/http.crossplane.io_requests.yaml
index 5c09897..ef57d72 100644
--- a/package/crds/http.crossplane.io_requests.yaml
+++ b/package/crds/http.crossplane.io_requests.yaml
@@ -546,6 +546,10 @@ spec:
                           - name
                           - namespace
                           type: object
+                        setOwnerReference:
+                          description: SetOwnerReference determines whether to set
+                            the owner reference on the Kubernetes secret.
+                          type: boolean
                       required:
                       - responsePath
                       - secretKey