diff --git a/cmd/flux/create_secret_tls.go b/cmd/flux/create_secret_tls.go
index b244a6c5..82f36743 100644
--- a/cmd/flux/create_secret_tls.go
+++ b/cmd/flux/create_secret_tls.go
@@ -110,10 +110,10 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if secretTLSArgs.tlsCrtFile != "" && secretTLSArgs.tlsKeyFile != "" {
-		if opts.TlsCrt, err = os.ReadFile(secretTLSArgs.tlsCrtFile); err != nil {
+		if opts.TLSCrt, err = os.ReadFile(secretTLSArgs.tlsCrtFile); err != nil {
 			return fmt.Errorf("failed to read cert file: %w", err)
 		}
-		if opts.TlsKey, err = os.ReadFile(secretTLSArgs.tlsKeyFile); err != nil {
+		if opts.TLSKey, err = os.ReadFile(secretTLSArgs.tlsKeyFile); err != nil {
 			return fmt.Errorf("failed to read key file: %w", err)
 		}
 	} else if secretTLSArgs.certFile != "" && secretTLSArgs.keyFile != "" {
diff --git a/pkg/manifestgen/sourcesecret/options.go b/pkg/manifestgen/sourcesecret/options.go
index 96e192c3..71b5f8bf 100644
--- a/pkg/manifestgen/sourcesecret/options.go
+++ b/pkg/manifestgen/sourcesecret/options.go
@@ -34,18 +34,22 @@ const (
 	UsernameSecretKey   = "username"
 	PasswordSecretKey   = "password"
 	CACrtSecretKey      = "ca.crt"
-	TlsCrtSecretKey     = "tls.crt"
-	TlsKeySecretKey     = "tls.key"
+	TLSCrtSecretKey     = "tls.crt"
+	TLSKeySecretKey     = "tls.key"
 	PrivateKeySecretKey = "identity"
 	PublicKeySecretKey  = "identity.pub"
 	KnownHostsSecretKey = "known_hosts"
 	BearerTokenKey      = "bearerToken"
 
-	// Depreacted: These keys are used in the generated secrets if the
-	// command was invoked with the deprecated TLS flags.
-	CAFileSecretKey   = "caFile"
+	// Deprecated: Replaced by CACrtSecretKey, but kept for backwards
+	// compatibility with deprecated TLS flags.
+	CAFileSecretKey = "caFile"
+	// Deprecated: Replaced by TLSCrtSecretKey, but kept for backwards
+	// compatibility with deprecated TLS flags.
 	CertFileSecretKey = "certFile"
-	KeyFileSecretKey  = "keyFile"
+	// Deprecated: Replaced by TLSKeySecretKey, but kept for backwards
+	// compatibility with deprecated TLS flags.
+	KeyFileSecretKey = "keyFile"
 )
 
 type Options struct {
@@ -61,17 +65,21 @@ type Options struct {
 	Username            string
 	Password            string
 	CACrt               []byte
-	TlsCrt              []byte
-	TlsKey              []byte
+	TLSCrt              []byte
+	TLSKey              []byte
 	TargetPath          string
 	ManifestFile        string
 	BearerToken         string
 
-	// Depreacted: These fields are used to store TLS data that
-	// specified by the deprecated TLS flags.
-	CAFile   []byte
+	// Deprecated: Replaced by CACrt, but kept for backwards compatibility
+	// with deprecated TLS flags.
+	CAFile []byte
+	// Deprecated: Replaced by TLSCrt, but kept for backwards compatibility
+	// with deprecated TLS flags.
 	CertFile []byte
-	KeyFile  []byte
+	// Deprecated: Replaced by TLSKey, but kept for backwards compatibility
+	// with deprecated TLS flags.
+	KeyFile []byte
 }
 
 func MakeDefaultOptions() Options {
diff --git a/pkg/manifestgen/sourcesecret/sourcesecret.go b/pkg/manifestgen/sourcesecret/sourcesecret.go
index 4f8ccacc..25d3f59a 100644
--- a/pkg/manifestgen/sourcesecret/sourcesecret.go
+++ b/pkg/manifestgen/sourcesecret/sourcesecret.go
@@ -162,9 +162,9 @@ func buildSecret(keypair *ssh.KeyPair, hostKey, dockerCfg []byte, options Option
 		secret.StringData[CAFileSecretKey] = string(options.CAFile)
 	}
 
-	if len(options.TlsCrt) != 0 && len(options.TlsKey) != 0 {
-		secret.StringData[TlsCrtSecretKey] = string(options.TlsCrt)
-		secret.StringData[TlsKeySecretKey] = string(options.TlsKey)
+	if len(options.TLSCrt) != 0 && len(options.TLSKey) != 0 {
+		secret.StringData[TLSCrtSecretKey] = string(options.TLSCrt)
+		secret.StringData[TLSKeySecretKey] = string(options.TLSKey)
 	} else if len(options.CertFile) != 0 && len(options.KeyFile) != 0 {
 		secret.StringData[CertFileSecretKey] = string(options.CertFile)
 		secret.StringData[KeyFileSecretKey] = string(options.KeyFile)